CurrentActivity

CURRENT ACTIVITIES
Critical remote code execution vulnerabilities in PHP

Original Issue Date:October 22, 2026

Multiple vulnerabilities have been reported in PHP which could allow a remote attacker to execute arbitrary code on the targeted system.

Target Audience:
All organizations and individuals using PHP.

Risk Assessment:
High risk of remote code execution and complete system compromise.

Impact Assessment:
Potential for remote code execution and compromise of the affected systems.

Software Affected

PHP 8.5 versions prior to 8.5.12
PHP 8.4 versions prior to 8.4.27
PHP 8.3 versions prior to 8.3.36
PHP 8.2 versions prior to 8.2.35

Description

PHP is an open-source scripting language designed for server-side web development, enabling the creation of dynamic web pages.

These vulnerabilities exist in PHP due to memory corruption and improper resource control. A remote attacker could exploit these vulnerabilities by sending a specially crafted request to the targeted system.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code and com-promise of affected systems on the targeted system.

Note: Multiple reports confirm large scale exploitation in the wild, users are advised to patch urgently.

Solution

Apply appropriate security updates and mitigations as recommended below:
https://www.php.net/archive/2026.php#2026-10-21-5

Vendor Information

PHP
https://www.php.net/

References

https://www.php.net/archive/2026.php#2026-10-21-5

CVE Name

CVE-2026-109618
CVE-2026-109619

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email:info@cert-in.org.in
Phone: +91-11-22902657

Postal Address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India

CURRENT ACTIVITIES Critical remote code execution vulnerabilities in PHP

CURRENT ACTIVITIES
Critical remote code execution vulnerabilities in PHP