PHP Critical Vulnerabilities: Emerging Threat published on Risk Ledger

Summary

PHP has disclosed and released updates to address two critical vulnerabilities affecting PHP installations, CVE-2026-109618 and CVE-2026-109619. PHP's security team rates both 9.2 (Critical) on CVSS v4.0, and report that both vulnerabilities allow remote code execution from unauthenticated requests.

These vulnerabilities have been mitigated in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP versions 8.1 or older no longer receive updates, so you may need to contact your vendor for support or upgrade to a supported version. However, PHP has released minimal source-backports for  PHP 7.4, PHP 8.0, and PHP 8.1 due to the severity of these vulnerabilities.
‍

Threat Description

On 20 October 2026, details of two critical PHP vulnerabilities were posted online before their coordinated disclosure date. PHP published an advance notice and published an out-of-cycle security release on 21 October 2026 at 15:00 BST.

The criticality of this release is reinforced by advisories from the UK National Cyber Security Centre (NCSC) and CERT-EU.  Detailed technical information can be found from PHP’s advisories for each vulnerability: CVE-2026-109618 and CVE-2026-109619.

Both vulnerabilities have the potential to provide malicious actors with remote code execution on applications using vulnerable versions of PHP. Updating to the patched versions is the only complete mitigation strategy.

As of 21 October 2026, there has not been any official public reports of in-the-wild exploitation, however, Cloudflare CTO, Dane Knecht, posted about observing emerging attack activity.

Applicability

These vulnerabilities applies to all PHP installations serving web requests; therefore, it is highly encouraged to update to the patched versions as soon as possible.
‍

Relevance to the supply chain

PHP underpins the development of many websites and web applications. It is also frequently bundled inside commercial software and appliances without being advertised. Your suppliers are therefore likely to run PHP somewhere across their infrastructure.

It is important to assess the potential impact of these vulnerabilities, both through your organisation's own PHP deployments and through those of your suppliers. Successful exploitation of a supplier's PHP application could disrupt critical services, provide an entry point into your network through trusted connections, or expose sensitive data your suppliers manage on your behalf.
‍

What should you do about it

If your organisation runs PHP, follow the general actions recommended by NCSC below along with the steps outlined in PHP’s security advisory.

1. Identify systems running any version of PHP across your infrastructure, prioritising internet-facing systems
2. Apply the latest updates to versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as described in the PHP official guidance
3. Perform monitoring of internet-facing PHP systems for malicious activity.
4. Monitor for security updates from third-party software vendors who may bundle PHP as a component.
5. If you are unable to update PHP immediately, follow the guidance for each CVE to help reduce exposure until you can install the updates.
6. Consider taking some systems offline if updates or mitigations cannot be applied in the near-term.
7. Assess your environment for any evidence of malicious activity that may have occurred due to these vulnerabilities.
   ‍

Where to find more information

This is an ongoing situation and information will likely be continually updated. PHP's advisory contains the latest information and links to fixed releases:

PHP Security Advisory

Technical details for CVE-2026-109618

Technical details for CVE-2026-109619

Government advisories:

NCSC: Critical security issue affecting PHP

CERT-EU: Security Advisory 2026-018

‍