Vulnerability

CERT-In Vulnerability Note CIVN-2026-0528
Remote Code Execution Vulnerability in PHP

Original Issue Date:October 27, 2026

Severity Rating: CRITICAL

Software Affected

PHP 8.2 versions prior to 8.2.35
PHP 8.3 versions prior to 8.3.36
PHP 8.4 versions prior to 8.4.27
PHP 8.5 versions prior to 8.5.12

Overview

A vulnerability has been reported in PHP which could allow a remote attacker to gain access to sensitive information or execute arbitrary code on the targeted system.

Target Audience:
Administrators and users of PHP-based web applications.

Risk Assessment:
High risk of information disclosure and remote code execution.

Impact Assessment:
Potential for complete system compromise.

Description

PHP is a widely used open-source scripting language for developing dynamic websites and web applications.
This vulnerability exists in PHP due to memory corruption and memory disclosure flaws. A remote attacker could exploit these vulnerabilities by sending a specially crafted request to the targeted system.

Successful exploitation of these vulnerabilities could allow an attacker to gain access to sensitive information or execute arbitrary code on the targeted system.

Solution

Apply appropriate security updates and mitigations as recommended by the vendor:
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Vendor Information

PHP
https://www.php.net/archive/2026.php

References

https://www.php.net/archive/2026.php#2026-10-23-1
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

CVE Name
CVE-2026-109619

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India