A security defect in PHP is a potential doorway into an enormous part of the web, not proof that every PHP site has been compromised. On 21 October, the PHP security team released fixes for two critical flaws that can permit code execution by an unauthenticated request. Its advisory singles out web-serving installations and says a demonstrated mod_php path can trigger before application code runs. Hosting teams now face a race to patch. This forecast asks whether US cyber officials find enough evidence of attacks in the wild to put either flaw on the government's exploited-vulnerability list by 30 November.
What is known.
The PHP team released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It identifies CVE-2026-109618, involving corruption during out-of-memory handling, and CVE-2026-109619, involving stale request state. The advisory gives mitigations for sites that cannot immediately upgrade but stresses that patching is the main response.
CISA's Known Exploited Vulnerabilities catalog is a narrower signal than a severity score. Inclusion requires evidence of real-world exploitation. A high CVSS score by itself does not satisfy the forecast.
What earlier cases show.
The web has repeatedly seen attackers move quickly after public fixes to high-impact server software. That general pattern is not a measured base rate for these two PHP bugs: the exploit paths and patch rollout differ across server configurations. The present test therefore uses CISA's public catalog rather than assuming attacks from severity alone.
Why it is a possibility.
Public advisories and released patches can help defenders act, but they can also help attackers identify vulnerable installations. Older or unmaintained installations may persist. If a credible campaign emerges, CISA has a clear mechanism to flag the flaw.
The countercase is substantial: memory-corruption exploits can be brittle, many providers can update centrally, and CISA may not publish an entry even if isolated attacks are alleged. The forecast is about an official exploitation finding, not the total number of affected sites.
How the 46% was assessed.
Reference point. No defensible measured rate exists for newly disclosed critical PHP flaws entering CISA KEV in a 40-day window. Forty-six percent is editorial judgment with a 30–62% sensitivity band.
Why it could be higher. The flaws are remotely reachable in web-serving PHP, one path can run before application code, and the PHP team urged immediate fixes.
Why it could be lower. Updated packages are available, exploit reliability may vary, and CISA inclusion requires evidence rather than theoretical severity.
The editorial judgment. A public exploitation finding is a serious near-even possibility, but the patch window and evidentiary threshold keep it below 50%.
Limits of the estimate. The number of vulnerable installations and private incident reports are unknown. The band is editorial sensitivity, not a statistical confidence interval.
What could prevent it.
Rapid patching, varied deployment configurations, and the difficulty of weaponizing memory corruption across targets may prevent confirmed exploitation. CISA may also lack sufficient evidence or delay publication despite incidents.
How it will be assessed.
YES only if the US Cybersecurity and Infrastructure Security Agency adds CVE-2026-109618 or CVE-2026-109619 to its official Known Exploited Vulnerabilities Catalog with a dateAdded from 22 October through 30 November 2026 inclusive, by 23:59 UTC on 30 November. Reports of scanning, proof-of-concept code, vendor warnings, an unverified breach, or catalog entries for other PHP flaws do not count. If the full deadline passes and CISA catalog records remain available without either qualifying entry, resolve NO; if catalog records cannot be checked, leave open.
Sources and primary records
Probabilities are provisional editorial estimates, not guarantees. Sources document the present evidence and resolution rule. Read the full disclaimer.