Critical PHP Security Alert: Two Critical Vulnerabilities

Severity Level: Critical

Date: 21/10/2026

Ref: CERT-NCSOC-0232

TLP: CLEAR

Components Affected

PHP-based applications and services, including products that bundle PHP.
PHP 5 and later versions may be affected, according to CERT-EU.
Exact affected and fixed versions remain subject to confirmation in official PHP release notes and vendor advisories.

Overview

On 20 October 2026, the PHP security team announced an upcoming release addressing two critical vulnerabilities, scheduled for 21 October 2026 at 14:00 UTC (19:30 Sri Lanka Standard Time).

CERT-EU warns that these vulnerabilities may potentially allow unauthenticated remote code execution (RCE) on affected systems.

Organizations operating PHP-based websites, applications, and hosting environments are advised to review their PHP deployments and monitor official security updates.

Description

The following two critical vulnerabilities have been identified:

CVE-2026-109618 (CVSS v4.0: 9.2): A critical PHP vulnerability with potential for unauthenticated remote code execution. The detailed root cause and exploitation method have not yet been confirmed in the information available for this advisory.
CVE-2026-109619 (CVSS v4.0: 9.2): A second critical vulnerability with potential for unauthenticated remote code execution. Detailed technical information and confirmed affected and fixed PHP versions remain pending official confirmation.

Administrators should consult the official PHP security announcements and relevant vendor advisories to determine the affected versions and appropriate security updates.

Impact

Successful exploitation could allow attackers to execute code on vulnerable systems, potentially compromising websites, applications, and hosting environments.

Depending on the application's permissions and configuration, exploitation could result in:

Unauthorised remote code execution
Unauthorised access to sensitive information
Modification or deletion of application data
Website defacement
Service disruption or application compromise
Further malicious activity within affected hosting environments

Solution / Workarounds

Organizations and system administrators are advised to take the following precautionary and remediation measures.

Before security patches are available:

Identify all PHP deployments and record the currently installed versions.
Monitor official PHP security announcements and relevant vendor advisories.
Assess restricting public access to vulnerable systems if immediate patching is not possible.
Verify the availability and integrity of system and application backups.
Prepare incident-response procedures to address potential exploitation.

Once security patches are released:

Upgrade to the appropriate fixed PHP version following official PHP or vendor instructions.
Update bundled PHP installations through the responsible product vendor.
Verify that security updates have been successfully installed.
Review application, web server, and system logs for suspicious activity.
Escalate any suspected compromise to the organization's incident-response team.

Reference

Disclaimer

The information provided herein is on an "as is" basis, without warranty of any kind. This advisory reflects information available from the cited sources at the time of publication. Administrators should consult the official PHP release notes and their vendors for confirmed affected versions and fixed releases.