Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619): An internet exposure report

What PHP says

On 20 October 2026, the PHP security team announced a critical security release for 21 October at 14:00 UTC. It fixes two critical vulnerabilities, both rated CVSS v4.0 9.2. Affected and fixed versions will be published with the release, and PHP may release earlier if details leak or exploitation appears.

PHP currently supports 8.2 (security fixes until 31 December 2026), 8.3, 8.4 and 8.5. Their current releases are 8.2.34, 8.3.35, 8.4.26 and 8.5.11, all from 24 September 2026 (supported versions). 8.6.0 is in release-candidate testing. Older branches, including 8.0 and 8.1, are end of life, so this post treats them as getting no official fix.

What others report

Press coverage names the bugs CVE-2026-109618 and CVE-2026-109619 and describes them as remote code execution. A leaked post claimed every version since PHP 5 is affected. PHP has confirmed none of this, so we do not assume any version is or is not affected. What we can show is which versions are deployed and which branches PHP still supports.

The headline numbers

We queried Modat’s internet scan data on 20 October 2026.

• 4,384,302 PHP services on 1,886,612 unique hosts.
• 3.47 million services (79%) run a branch PHP no longer supports: 4.x, 5.x, 7.x, 8.0 or 8.1. This share is taken from services where a PHP version could be read.
• 897,379 services (20%) run a supported branch, 8.2 to 8.5.
• 1,410,980 hosts (75% of all PHP hosts) run an unsupported branch, and 531,398 hosts (28%) run 8.2 to 8.5.
• 89 services report 8.6.0, a release candidate, and are left out of these shares.

Where the unsupported weight sits

The largest single group is not an ancient release. PHP 7.4, end of life since 2022, accounts for 878,761 services, more than any supported branch. PHP 5.3 follows with 486,684, then PHP 7.2 with 461,965.

Already on the newest release

Services on PHP’s current builds patch quickly, but whether those builds are affected will only be stated with the 21 October release.

Where PHP runs

By unique hosts, the United States leads with 428,330, followed by China (152,208), Japan (140,294), Germany (129,623), France (83,383) and Russia (63,150). The map shows every country. Switch the measure between hosts, services and each country’s share, and filter by version: all of PHP, the supported branches, the end-of-life ones together, or any single branch from 4.x to 8.5. Hover over a country for its figures.

Full results

Everything below comes from a Modat snapshot taken on 20 October 2026. We also hold the country breakdown for every version with at least 1,000 services, up to 50 countries each.

Every minor branch

Hosts are unique IPs with a PHP service on that branch. 8.6 is a release candidate, not for production.

Every PHP patch version

All 579 patch versions found based on extracted versions by Modat Magnify.

Every country

All 233 countries and territories with at least one PHP service, ordered by unique hosts. Host columns count unique IPs by branch group (4.x, 5.x, 7.x, 8.x). “8.2 to 8.5” hosts will receive the fix.

Ports

Ports where PHP runs.

See your own exposure

If you run or protect PHP, Modat Magnify shows which internet-facing services answer as PHP, and on which version. Use this query in Magnify to see every service reporting PHP 8.2.34, as an example:

fingerprints.technologies.name="php" fingerprints.technologies.version="8.2.34"

Run this query in Modat Magnify

Change the version number to check any other build you run. PHP has not yet said which versions are affected, so use the query to find where you run PHP, then compare against the release notes once PHP publishes them on 21 October. To discuss the data behind this post, contact us.

About Modat

Modat is a European Internet Intelligence company helping organisations understand the intent behind internet infrastructure before it is weaponised. By continuously mapping, profiling and analysing internet-scale infrastructure, Modat turns fragmented data into trusted intelligence that helps security teams investigate threats faster, understand adversaries more deeply and prevent attacks before they occur. Built for both analysts and the agents they deploy, the Modat platform integrates with existing security workflows to provide the context, relationships and confidence needed to stay ahead. Governments, national CERTs, critical infrastructure operators, security companies and enterprises rely on Modat to make faster, better-informed security decisions. Learn more at modat.io.