The PHP Security Team released security updates on Wednesday to address two critical vulnerabilities in PHP. Exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely on systems running vulnerable PHP versions.
The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619, both of which have a Common Vulnerability Scoring System (CVSS) score of 9.2 out of 10.
Updates are available for the supported PHP versions:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
What should you do?
Z-CERT strongly advises organisations to install these security updates as a matter of urgency. Check as soon as possible which PHP versions are currently in use within your environment. Please note that updates distributed through Linux distributions, hosting providers and software vendors may not be available immediately.
After installation, verify that your applications are actually using the updated PHP runtime. No security updates are available for unsupported (end-of-life) PHP versions.
Where immediate patching is not possible, carry out a risk assessment and consider temporarily taking the affected system offline until the update can be installed.
Please note: Linux distributions follow their own release schedules for security updates. As a result, updates for your systems may become available at a later date. Examples include Debian, Ubuntu, Fedora, AlmaLinux and Red Hat.
Further information is available via the PHP security advisories and the security advisories published by operating system vendors.