PHP maintainers issue emergency updates for two critical code execution vulnerabilities

PHP maintainers have released emergency security updates to address two critical vulnerabilities that allow unauthenticated remote code execution, Schneier on Security and Howl.link reported. According to Unit 42, the two critical vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619. CyberSecurityNews and PCMag Middle East reported that hackers began targeting the flaws before and during the release of the patches. [1][3][4][6][7][10]

The updates are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, according to Schneier on Security. Schneier on Security reported that all PHP installations serving web requests are at risk, including setups running PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. [1]

The National Security Agency issued an advisory recommending critical patches for the PHP vulnerabilities, the NSA reported. PHP is a general-purpose scripting language created by Rasmus Lerdorf in 1993 and released in 1995, and its reference implementation is produced by the PHP Group. Unit 42 noted that the language is used globally for web servers and content management systems. [5][7][12][13]

Schneier on Security and the National Security Agency strongly urge all system administrators using PHP to update their installations immediately to prevent remote exploitation. [1][5][12]