Critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619 #
The PHP Foundation has announced a security release scheduled for October 21, 2026 that addresses two critical vulnerabilities, both rated CVSS 9.2. Public reporting indicates that these are remote code execution vulnerabilities:
- CVE-2026-109618: A critical remote code execution vulnerability in PHP. Technical details have not yet been published.
- CVE-2026-109619: A critical remote code execution vulnerability in PHP. Technical details have not yet been published.
Applications that run on PHP, such as content management systems, e-commerce platforms, and web frameworks, may be exposed through a vulnerable PHP runtime.
The following versions are affected
- PHP: Affected versions have not yet been confirmed. Unverified reporting indicates that versions 5.4.0 and later may be affected.
Note: Details, affected versions, and fixed versions will be published with the PHP security release.
What is PHP? #
PHP is a widely used open-source, general-purpose scripting language for web development. It runs web applications and content management systems, often through mod_php, PHP-FPM, or CGI.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process, potentially leading to full compromise of affected web applications and underlying server infrastructure.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- PHP 8.x: Upgrade to the fixed release published in the PHP security release of October 21, 2026, or later.
- PHP 7.x and earlier: Migrate to a fixed release.
Note: PHP versions prior to 8.x have reached end of life and may not receive a patch.
Finding exposed PHP installations with runZero #
From the Software Inventory, use the following query to locate systems running potentially vulnerable software:
vendor:=PHP AND product:=PHP
