SB Sentinel BreachWatch BreachWatch threat desk · cyber and synthetic intelligence

Active exploitation

The PHP flaws are being exploited. Here is what is established — and what is not yet

Working exploits are public and in use. A verified outage count is not yet published, and we will not estimate one.

Published 21 October 2026

On Wednesday, Krebs on Security reported that the two PHP vulnerabilities now carry working public exploits and are being exploited in the wild, and that roughly 70 percent of websites run affected core software. CVE-2026-109618 and CVE-2026-109619 allow an attacker to seize full control of an affected server.

both CVE numbers; working exploits in public circulation; active exploitation; the affected stack — WordPress, Drupal, Joomla and Magento all sit on top of it; and the origin. Per the PHP Foundation, one of the two flaws dates to 2024, and the Foundation published information earlier than planned after a third-party AI review drew fresh attention to both.

a verified count of how many sites actually went down. The Record reported hundreds offline on Wednesday afternoon. As of this morning no published total has been seen, and we are not going to estimate one. When a source publishes a figure, we will carry it.

That gap is the whole reason this desk exists. "May cause many site outages" is a prediction. A count is a measurement. We report the second, and we tell you which one you are reading.

If your site runs PHP, in order

  1. First, ask whether the patched version is applied. Most managed hosts will have done it. The exposure sits with self-managed and unmaintained installs.
  2. Second, if nobody owns your site's updates, that is the finding. An unowned install is the actual risk — not this particular flaw.
  3. Third, if you hold customer or patient data on that site, an unpatched install is a notification obligation waiting to happen. That is a legal exposure, not just a technical one.

Sources

Presented by Sunny Burns · SB Sentinel Breach Watch