Swiss SME Cyber Alert on actively exploited PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Swiss SME Cyber Alert: Business websites – critical PHP flaws are being actively exploited

16 hours ago

2 min read

Amazon reports that two critical PHP vulnerabilities are already being actively exploited. PHP powers many business websites, WordPress sites and online shops; attackers can make vulnerable web servers execute code without signing in. If your company operates a website or online shop, ask your web or IT provider to update PHP now and investigate signs of compromise dating back to 17 October 2026.

What happened?

The PHP project released emergency updates for CVE-2026-109618 and CVE-2026-109619 on 21 October 2026. Both flaws affect PHP installations that process web requests. A successful attack can execute code with the privileges of the PHP process; CVE-2026-109619 may also disclose memory contents. Amazon observed the first exploitation attempt on 17 October and now describes the flaws as being broadly exploited in the wild.

Could my business be affected?

Yes, if a public website, customer portal or online shop runs on PHP, whether on your own server or through a hosting or web provider. WordPress, WooCommerce, Drupal, Joomla and Magento often rely on PHP. The crucial point is the PHP version on the underlying web server.

What should you do now?

Ask your web or IT provider to complete these actions today:

• Inventory every internet-facing PHP system and hosting package.

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or to a demonstrably patched package supplied by the operating-system or hosting vendor.

• Review web-server logs, unexpected processes and file changes for possible compromise from at least 17 October 2026.

PHP 8.1 and earlier no longer receive regular updates from the PHP project. Your provider must confirm whether a backport is available or an upgrade is required.

How urgent is it?

Very urgent. The attacks require no authentication, working exploits appeared immediately after the updates were released, and configuration changes alone do not provide complete protection. Internet-facing systems should be checked within hours, not weeks.

Information for your IT provider

CVE-2026-109618: remote code execution through out-of-memory corruption. CVE-2026-109619: remote code execution through stale global state or use-after-free; memory disclosure is also possible.

Affected request-processing PHP stacks include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Fixed upstream versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. For distribution or LTS packages, verify the vendor's actual backported fix.

Threat hunting from 17 October 2026: check POST requests containing PHP_SESSION_UPLOAD_PROGRESS, suspicious web-server child processes and unexpected file changes.

AWS investigation indicators: 103.216.220.92, 31.223.184.166, 37.19.200.5, 134.209.159.64, 103.114.163.188, 95.217.98.37. Because some may be shared anonymisation infrastructure, treat them as investigative leads rather than a standalone blocklist.

Official sources

PHP project: https://www.php.net/archive/2026.php

AWS Security Blog: https://aws.amazon.com/blogs/security/php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/