Vietnam cybersecurity authorities urge calm over two critical PHP flaws

On October 22, Vietnam's Cybersecurity Department and the National Cybersecurity Association issued an advisory concerning two critical vulnerabilities in the PHP programming language, identified as CVE-2026-109618 and CVE-2026-109619.

PHP is widely used to power e-commerce websites, online portals and content management systems (CMS) around the world.

The two vulnerabilities were discovered by cybersecurity company Wiz in collaboration with research teams using artificial intelligence (AI).

Both received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS) version 4.0.

If successfully exploited, the flaws could allow attackers to execute malicious code remotely on PHP-based web servers without authentication.

According to the advisory, the level of risk varies depending on the PHP version in use and how each system is deployed.

Exploiting the vulnerabilities also requires specially crafted requests and precise manipulation of memory conditions, meaning the presence of a vulnerable PHP version does not automatically imply that a system can be easily compromised.

Systems equipped with properly configured web application firewalls (WAFs) may be able to detect and block suspicious requests, significantly reducing the likelihood of successful attacks.

Many hosting and cloud service providers have already begun deploying security patches and additional defensive rules across their shared server infrastructure.

Organizations using third-party hosting services are advised to their providers to confirm whether the necessary protections have been implemented.

The PHP development team has released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

For older branches that have reached the end of official support, including PHP 7.4, 8.0 and 8.1, fixes have been made available in source-code form.

Linux distributions such as Red Hat, Ubuntu, Debian and AlmaLinux have also released their own update packages.

PHP versions 7.3 and earlier are not receiving patches and must be upgraded.

The advisory emphasized that the discovery and disclosure of security vulnerabilities are normal parts of the technology ecosystem.

"The important thing is that patches are available, service providers have begun responding, and organizations have enough information to take action," the authorities said. "The priority now is systematic assessment, patching according to risk and continuous monitoring, rather than excessive concern."

Recommendations for businesses and individual users

For organizations and businesses operating their own servers, the Cybersecurity Department and the National Cybersecurity Association recommended four immediate measures.

1. Conduct a comprehensive system inventory

Organizations should identify all servers, websites, applications and environments running PHP, including their current versions.

This assessment should cover testing environments, containers and rarely maintained servers, as overlooked systems are often involved in security incidents.

2. Apply security patches promptly

Administrators should upgrade to one of the patched PHP versions listed above.

The advisory noted that the PHP project no longer provides official security updates for PHP 8.1 and earlier branches because they have reached the end of their support lifecycle.

Organizations still using these versions should plan migrations to supported releases or implement additional protective measures while awaiting upgrades.

3. Reduce attack exposure through WAFs and system configuration

Businesses should enable web application firewalls and update their filtering rules.

They should also restrict request sizes and volumes at the web server or proxy level and review PHP memory limits.

All configuration changes should be carefully tested before deployment to avoid disrupting normal application operations.

4. Strengthen access-log monitoring

System administrators should monitor unusual requests, including abnormally large requests, excessive request frequency, repeated out-of-memory errors, unexpected PHP process termination and unfamiliar files appearing on servers.

For ordinary Internet users, cybersecurity experts stressed that the vulnerabilities do not directly affect personal devices or web browsers because the flaws exist on the server side.

Online transactions and shopping activities can therefore continue as normal.

Nevertheless, users should maintain basic cybersecurity precautions, including enabling two-factor authentication (2FA), creating strong and unique passwords for each account, and remaining alert to fraudulent emails or messages.

In particular, users should be cautious of impersonation attempts that exploit security warnings to trick them into disclosing verification codes.

Experts emphasized that these protective habits should be maintained routinely, regardless of whether new vulnerabilities have been disclosed.