Critical Vulnerabilities in PHP

[aelius]

Summary

On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks

 

At this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available.

 

The PHP team has scheduled the release for 21 October 2026 at 14:00 UTC [1].

Technical Details

No technical details are currently available for CVE-2026-109618 and CVE-2026-109619, apart from their CVSS scores of 9.2, which indicate the potential for unauthenticated remote code execution

Affected Products

These vulnerabilities could affect all PHP versions from PHP 5 onwards 

Recommendations

CERT-EU strongly recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available. Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.

 

Ref:

 

- https://cert.europa.eu/publications/security-advisories/2026-018

- https://www.php.net/index.php#2026-10-20-1

 

Important: 

https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

https://jackalsyn.com/posts/php-up-2026.html

 

[Lazloboss]

Mulțumim 😍

[Nytro]

PHP e secure, nu are vulnerabilitati  

[aelius]

3 minutes ago, Nytro said:

PHP e secure, nu are vulnerabilitati  

 

Pai pornind de la stiva tcp/ip; e totul o copturǎ :))) Dar de acolo mancam, nu? 

[Nytro]

Mancam o paine si noi si agentii ❤️ 

[sicilianul]

Chiar citeam de dimineata de vulnerabilitatea asta. Nasol moment. E mult pana afla claudiu de el .... 

[aelius]

Distractie mare. Multi si-au oprit pur si simplu site-urile cu totul pana fac update-uri.

[Nytro]

debian@vps-78028d34:~$ sudo apt upgrade
Upgrading:
  php8.4-cli     php8.4-fpm  php8.4-intl      php8.4-opcache   php8.4-sqlite3  php8.4-xsl
  php8.4-common  php8.4-gd   php8.4-mbstring  php8.4-readline  php8.4-tidy     php8.4-zip
  php8.4-curl    php8.4-gmp  php8.4-mysql     php8.4-snmp      php8.4-xml
 

[sicilianul]

6 hours ago, aelius said:

Distractie mare. Multi si-au oprit pur si simplu site-urile cu totul pana fac update-uri.

Da da am vazut. Si noi am oprit pe la 16:30 si am vazut ca pe la 16:40 au inceput sa vina update-urile. 

[Cheater]

Eh, dai cu cloudflare in fata (+ fw cu allow in from cf ips), si lasi update pe mai tarziu: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

PS: omg, n-am mai intrat de cand eram copil, credeam ca s-a sters contu'