Two critical vulnerabilities have been identified in PHP (CVE-2026-109618 and CVE-2026-109619). By exploiting these, an attacker can execute arbitrary code remotely without prior authentication.
Both vulnerabilities have been assigned a score of 9.2 on the CVSS v4.0 scale and have been addressed in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
The National CERT recommends the following:
- Identify all systems and applications that use PHP, especially those accessible via the internet;
- Monitor activity on systems using PHP to detect any potential malicious behavior;
- Apply the relevant security updates for PHP versions 8.2, 8.3, 8.4 and 8.5;
- For PHP 8.1 and older versions which are no longer supported, it is recommended to upgrade to a supported version or apply any relevant security updates provided by the software vendor;
- Check for the availability of security updates for other software products that utilize PHP;
- If security updates cannot be applied in a timely manner, consider temporarily isolating web applications from public networks or implementing other protective measures to prevent exploitation of the vulnerabilities.
More details at:
https://www.php.net/archive/2026.php
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php