Patch Race · PHP runtime · demo
"PHP exploits: what's coming next?" · a reply in three acts

Beneath your app sits a runtime. Who patches it, and how fast?

On 21 October 2026 PHP shipped fixed releases for two critical flaws in the runtime itself (CVE-2026-109618 and CVE-2026-109619). Nothing in Laravel, WordPress or your own code can repair a runtime bug; only a new runtime can. Three acts: where the runtime sits and which of your controls live above it, a 14-day race between three patch policies on the real October timeline, and one automated patch run with a canary, a health gate and an auto-revert. Arrow keys ← → switch act, space pauses. Everything is simulated in the browser; nothing is probed and nothing leaves the page.

14 days from the advance notice, Mon 20 Oct 2026—
Mon 20 · 00:00simulation clock (UTC)
100 %still exposed · "don't touch it"
100 %still exposed · manual
100 %still exposed · automated

The stack, one request at a time—

Browsera visitor, or a scanner
Edge & WAFCloudflare, rules, rate limits
Web servernginx · Apache · LiteSpeed
PHP runtimephp-fpm · mod_php · lsphpPHP 8.3.35
FrameworkLaravel · WordPress · Drupal
Your codecontrollers, validation, auth
DatabaseMySQL · Postgres
Runtime build:
Press Play, or wait a moment.

Three fleets of 400 sites, one clock—

"If it works, don't touch it"no watch, no window; a few owners act on their own

0 %on a fixed build
—hours, fix → 90 %
0site-days exposed after a fix existed

Manualsomeone reads the advisory next morning, tests, books a change window

0 %on a fixed build
—hours, fix → 90 %
0site-days exposed after a fix existed

Automatedfeed watcher, package poll, canary, waves, health gate, auto-revert

0 %on a fixed build
—hours, fix → 90 %
0site-days exposed after a fix existed
vulnerable, no fix exists yetvulnerable, fix availableon a fixed build
Scrub the clockMon 20 · 00:00
Three identical fleets. The same advisory, the same fixed releases, the same calendar. Only the patch policy differs.

Share of sites still on a vulnerable runtime

"If it works, don't touch it"ManualAutomated
Assumptions, not measurements: 400 sites per fleet; the fixes become available Tue 21 Oct 13:30 UTC; "don't touch it" has no process, so only the 8 % of owners who act alone move, around day 9; "manual" starts the next business morning and finishes per site after a lognormal 4-day median (ticket, staging test, change window); "automated" sees vendor packages after 1.7 h, canaries one site, rolls the rest out in waves over 3 h, and the 2 % that fail their health check are auto-reverted and handled by a person the next day. Change the policy and you change the story; the calendar stays.

Automated patch run · 53 sites on one server—

0on a fixed build
0held, needs a decision
0auto-reverted
0:00elapsed since the advisory
// the run log appears here
Idle. The watcher polls the release feed every five minutes.
Press Play to replay the run from the moment the advisory appears. Hit Break the canary first to see the safety net.

What is real here, and what is not

"The real competitive advantage in cybersecurity won't be who has the biggest firewall. It will be who can detect, understand and respond to vulnerabilities the fastest."The post this demo answers. Act 2 is that sentence with a clock on it.

The dates, version numbers and scope come from the public advisories and vendor write-ups linked below. The fleets, the sites, the patch-time distributions and the run log are simulations built to make the policies comparable. No server was contacted by this page.

The advisoriesTwo critical runtime flaws, fixed 21 Oct 2026CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4 9.2, both allowing unauthenticated code execution with the web worker's privileges. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Scope per the release notes: every installation serving web requests, whichever SAPI.
The timelineLeaked a day early, PoCs the day afterMon 20 Oct: details leaked ahead of the embargo; the PHP team published an advance notice. Tue 21 Oct ~13:30 UTC: fixed releases. Wed 22 Oct: Rapid7 noted multiple public proof-of-concepts, each tied to one OS, version and web server. Thu 23 Oct: a further PHP advisory with a mitigation but no patch yet.
Why your code could not helpThe runtime starts before the app doesA runtime flaw lives below the framework, the middleware and your validation. The vendor rated mod_php the most exposed because the flaw can be reached before any application code runs. The complete fix is a new runtime; the vendor's interim settings only reduce exposure.
How much of the web could patchAbout a third, on a covered branchBitsight's scan found that only about a third of the PHP instances whose version it could identify ran a branch covered by the release (8.2 to 8.5). The rest need a vendor backport or an upgrade first, which is why Act 2's "don't touch it" fleet barely moves.
What Act 3 is modelled onA real fleet script, with fictional sitesThe run order (feed watch, inventory from the server config, snapshot, canary, waves, health gate, auto-revert, hold, outside verification, one card) is how our own fleet tooling patches Drupal core and composer dependencies across the sites we host; the sites here are invented and the clock is compressed.
SourcesPublic write-ups used for the factsRapid7 · Huntress · Bitsight · Fastly · Kaspersky. Mechanism details are deliberately left out of this page.