The PHP security team issued a warning for administrators to prepare for emergency security updates to address two critical vulnerabilities, which have reportedly leaked ahead of schedule.
The vulnerability or weakness
Two remote code execution (RCE) flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0, affect PHP versions 5, 6, 7, and 8.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | No | - |
| CVE-2026-109619 | 9.2 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations using PHP in critical systems could face significant operational disruptions and potential financial losses if exploited, as these vulnerabilities allow for remote code execution.
Industries affected
The vulnerabilities impact a wide range of industries, including e-commerce, content management, and web services.
Users affected
Not stated in the sources.
Build these skills
Sources
- PHP warns admins of two critical flaws, emergency patches coming tomorrow (BleepingComputer)
