What happened
PHP.net announced a forthcoming critical security update for PHP, addressing two vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. The vulnerabilities have been confirmed to be actively exploited in the wild, prior to the release of a patch. Due to the widespread deployment of PHP across various online platforms and the severity rating of 9.4 on the CVSS scale, the alert level has been elevated to infocon yellow. Early proof-of-concept exploits have been observed, and the vulnerabilities are considered critical. The vulnerabilities' details have not yet been publicly disclosed, and no vendor fix was available at the time of the bug report from the SANS Internet Storm Center.
Who is affected
Organisations running PHP in their environments are at risk, particularly if deployments are exposed to internet-facing networks. The vulnerabilities could potentially impact any affected deployment where PHP processes handle untrusted input, enabling malicious actors to exploit the flaws prior to the distribution of security patches.
Recommended actions
- Monitor official PHP channels and security advisories for the release of the critical update.
- Prepare to apply the update promptly once it becomes available, especially if public exploits are observed or expected to be widely used in the wild.
- Review network perimeter controls to limit exposure of PHP-powered services to untrusted networks, particularly those accessible over the internet.
- Verify that exposure points where PHP is used are monitored to detect potential exploitation activity, such as unusual server activity or traffic anomalies.
