vNext Cyber-Alerts: PHP – actively exploited flaws threaten websites and online shops
Updated: 24 October 2026
Two critical PHP vulnerabilities are being actively exploited. Company websites, online shops and customer portals may be affected, including services run by external hosting providers. Ask your web or IT provider today to confirm that your services are protected and check for signs of compromise.
What happened?
PHP released security updates for CVE-2026-109618 and CVE-2026-109619 on 21 October 2026. Web requests can cause vulnerable systems to execute attacker-controlled code without authentication. Amazon Threat Intelligence detected an exploitation attempt on 17 October, before public disclosure, and now reports widespread active exploitation.
Could our business be affected?
Yes, if your website, shop or portal runs on PHP and its underlying service remains vulnerable. Check even if your hosting is managed. Updating a CMS or plugin does not establish that the PHP runtime itself is protected.
What should you do now?
Ask your web or IT provider to:
Identify internet-facing PHP services and confirm their effective security patch level.
Update PHP to a fixed release or apply a verified vendor backport, then check the services that are actually running.
Review web server logs, unexpected processes and file changes from at least 17 October. Arrange an incident-response investigation if there are signs of compromise.
Review PHP's additional 23 October guidance on session upload progress and apply the relevant protective measures.
How urgent is this?
Very urgent for internet-facing PHP services that remain vulnerable. Prioritise the review today and obtain confirmation of the work completed. Temporary security rules can reduce exposure but do not replace the security updates. Evidence of a successful attack requires further investigation.
Information for your IT provider
CVE-2026-109618 concerns memory corruption during out-of-memory handling; CVE-2026-109619 concerns stale global state after memory is freed. PHP identifies all web SAPIs for review, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed; risk is highest for mod_php.
Fixed upstream releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Verify the specific backport for distribution and hosting packages. Older branches require a vendor solution or an upgrade.
Additional guidance dated 23 October: PHP suggests session.upload_progress.enabled=0 until the next regular bugfix release for a separate, uncommon RCE path (CVE-2026-115560). It requires a particular combination of configuration and application behaviour. PHP says applications that never change the session serializer at runtime may leave the feature enabled. This additional issue is distinct from the two critical flaws already fixed.