CVE-2026-109618 and CVE-2026-109619 are the case numbers for the vulnerabilities which allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While the Cybersecurity and Infrastructure Security Agency (CISA) has not observed successful exploitation of these vulnerabilities, they do pose a risk to organizations if left unpatched.
- As a part of its php advisory, CISA urges organizations to take the following actions:
- Identify and inventory systems running any version of PHP across your organization. PHP is often a component of other software and prevalence may not be directly observable.
- Apply the patch immediately, prioritizing Internet-facing systems.
- Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can patch or update them.
- A web application firewall may provide some protection until you are able to update or patch systems.
- Review the official PHP security advisory for guidance on patching.
- Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.
CISA urges network defenders to review the following advisories and resources and apply necessary updates:
PHP’s Guidance
- PHP’s Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now
- PHP’s Blog: Today’s PHP Security Release, and How We’re Strengthening PHP Security
The following is some guidance from governmental partners across the globe:
United States National Security Agency’s (NSA) Advisory: Critical Patches Recommended for PHP VulnerabilitiesÂ
United Kingdom National Cyber Security Centre’s (NCSC-UK) Alert: Critical security issue affecting PHP
Australian Signals Directorate’s Australian Cyber Security Centre’s (ASD’s ACSC) Alert: Critical vulnerabilities in PHP
National Cyber Security Centre’s (NCSC-NL) GitHub repository: php2shellÂ
New Zealand National Cyber Security Centre’s (NCSC-NZ) NCSC encourages immediate patching against PHP vulnerability
Canadian Centre for Cyber Security’s (Cyber Centre) Alert: Critical vulnerabilities impacting PHP – CVE-2026-109618 and CVE-2026-109619Â
Organizations may also review CISA’s SIGMA detection rule to help identify potentially suspicious activity in relevant log sources: SIGMA Rules GitHub Repository.