I’m temped to write a short note here because something good and odd happened that I did not expect. Last Wednesday (21. October 2026), two critical PHP vulnerabilities were disclosed (CVE-2026-109618 and 619). Stern warnings were issued that patches for them should be applied as quickly as possible. The reason given was that it seemed likely that it would only take a short while until a way would be found to use them for remote code execution (RCE) without login or any other previous interaction with the target. It sounded really bad.
When the story broke, I immediately started looking at the information that was available. Particularly in combination with the recent significant advances in AI systems that can generate exploits, I found the threat credible and took immediate action. Like many others, I shut down my web services that were based on PHP before the release of the details on the vulnerabilities on Wednesday. Then, I waited for patches to become available and only started my services again once the patches were in place.
Patches for PHP itself on Ubuntu and other distributions where available within 30 minutes of the information released by the PHP project. I checked every few minutes and applied them to my Nextcloud installation immediately. Total downtime of my instance was around 3 hours, including the downtime before the information release, as I wanted to be on the safe side. The WordPress Docker image I used for this blog received an update around 3 hours after the downstream patches were released. So in the best case, the blog would have been down for around 5 hours. In practice, it was down for more than 12 hours, because I had another engagement on Wednesday evening. As a consequence, I only downloaded the latest images on the morning after and only then started the containers again.
So a lot of frenzy, a lot of downtime and a lot of work done in a hurry. However, much to my surprise, even after 5 days, mass exploitation is not happening. No Remote Code Execution (RCE) code anywhere. That really makes me wonder why!?
I would have expected that the latest coding optimized AI would spill out exploit code within the hour. It looks like the world has escaped a mass exploitation. This time. That doesn’t mean that nothing will ever be found but by then, everyone had more than a fair chance to protect their systems.
While this is good, it also has a bad side. Next time a ‘critical‘ issue comes along, a lot of people will be a lot more relaxed and be reluctant to take immediate action. Preventive shutdown of services in anticipation of doom will be a lot harder to justify. On the one hand, we can only hope that the next issue declared as ‘critical’ will be as hard to exploit as this one. On that other hand, that would weaken defenses even more, as people would be even less inclined to take immediate action the third time. But from my point of view, it is only a matter of time before we see a really critical issue with RCE minutes from publication.