Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

On October 20, 2026, the PHP security team issued an advance security advisory regarding two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting core PHP source code. Both vulnerabilities carry a critical-severity CVSS v4.0 score of 9.2 and could potentially allow unauthenticated remote code execution (RCE) on affected servers. 

The official patched PHP releases are scheduled for deployment on October 21, 2026, at 14:00 UTC. Given the potential impact across web applications, content management systems (CMS), and microservices running PHP, Detectify recommends immediate asset discovery and patching preparation.

What is the risk?

While specific technical implementation details remain under embargo until official patches ship, early advisories indicate:

• Unauthenticated Remote Code Execution (RCE): Both vulnerabilities allow remote attackers to execute arbitrary code on the underlying host operating system without prior authentication.
• Broad impact: Security advisories highlight that these flaws potentially affect all supported release branches and legacy environments (including PHP 5.x through 8.x).
• High attractiveness to attackers: Because PHP powers a vast majority of the public web, including platforms like WordPress, Drupal, Magento, and custom Laravel/Symfony applications, public exploit payloads are expected to follow shortly after official technical details are disclosed.

What are we doing?

The Detectify Security Research team is actively monitoring the situation:

• Assessment rollout: We are actively investigating the development of in-house automated detection assessments for our scanning engines to identify exposed, vulnerable PHP runtimes across customers’ attack surfaces without impacting service availability.
• Asset discovery: Detectify’s Surface Monitoring continuously maps internet-facing assets running PHP web applications, helping security teams locate shadow or legacy PHP workloads.

How to mitigate the threat

To ensure your organization remains protected, we recommend taking the following steps:

1. Inventory internet-facing assets: Use Detectify to run an asset discovery scan to identify all exposed HTTP service endpoints and web applications running on PHP.
2. Prepare patch pipelines: Alert application owners and infrastructure operators to prepare for emergency patch deployment as soon as updated PHP packages become available from your upstream package managers (Debian, Ubuntu, RHEL, Docker Hub, etc.).
3. Isolate high-risk services: If immediate patching is not possible following the release, temporarily isolate vulnerable application servers behind access-controlled gateways or Web Application Firewalls (WAFs) with strict filtering enabled.

References & official advisories

• PHP Foundation Announcement Archive (2026-10-20-1)
• CERT-EU Security Advisory 2026-018