Unit 42 warns of critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Unit 42 reported on October 29 that critical vulnerabilities designated as CVE-2026-109618 and CVE-2026-109619 affect PHP, a scripting language widely used on web servers and content management systems. Security researchers released hunting queries to help administrators detect post-exploitation command execution within PHP web server or worker processes. [1]

Unit 42 noted that the threat hunting queries are not exclusive to CVE-2026-109618 and CVE-2026-109619, as they can detect exploitation across various web application flaws. The organization advised system administrators to validate all detected activity, warning that certain legitimate web applications may produce false positive alerts. [1]

PHP is a popular programming language used to build many web application codebases. Memory safety flaws in PHP versions 5.4 through 8.5 can allow remote attackers to execute arbitrary code and gain remote control of website hosts. Emergency patches were previously released for PHP versions 8.2, 8.3, 8.4, and 8.5 following public disclosure of related flaws in October 2026. [4]

In separate security developments, SecurityWeek reported that Adobe, Veeam, and Juniper Networks issued patches for more than three dozen vulnerabilities across their product lines. SecurityWeek stated that Adobe resolved 12 security issues, including eight critical command injection, incorrect authorization, and cross-site scripting vulnerabilities in Campaign Classic. [2]