Skip to content
Critical PHP Vulnerabilities Prompt Urgent Updates

Critical PHP Vulnerabilities Prompt Urgent Updates

First seen 28 Oct 2026, 17:39 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 19:41 UTC
  • •Critical vulnerabilities in PHP allow unauthenticated remote code execution.
  • •All users of PHP 8.5 and 8.4 must update immediately to versions 8.5.12 and 8.4.27.
  • •CVE-2026-109618 is actively exploited and listed in CISA's KEV catalog.

The PHP development team has released PHP versions 8.5.12 and 8.4.27 to address two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. All users of PHP 8.5 and 8.4 are strongly encouraged to update immediately, as there are no complete mitigations available. CVE-2026-109618 was published on October 21, 2026, and has been since its addition to the CISA KEV list on October 26, 2026. The first public proof-of-concept for CVE-2026-109619 emerged shortly after its disclosure. The vulnerabilities pose a significant risk to systems running affected PHP versions, making immediate updates essential for security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Two critical vulnerabilities allowing remote code execution were disclosed, affecting PHP versions 8.4 and 8.5.
github.com
2026-10-24
First public PoC for CVE-2026-109619 released
A proof-of-concept for CVE-2026-109619 was made publicly available, increasing urgency for updates.
github.com
2026-10-26
CVE-2026-109618 added to CISA KEV
CISA added CVE-2026-109618 to its Known Exploited Vulnerabilities catalog, confirming active exploitation.
github.com
2026-10-28
PHP 8.5.12 and 8.4.27 released
The PHP development team released security updates to patch the critical vulnerabilities, urging immediate user action.
github.com

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (2)

1 / 2

Common questions

Which PHP versions are affected?
PHP versions 8.4 and 8.5 are affected by the vulnerabilities CVE-2026-109618 and CVE-2026-109619.
How urgent is the update?
The update is critical due to active exploitation of the vulnerabilities; immediate action is required.
What should I do to protect my systems?
Upgrade to PHP versions 8.5.12 or 8.4.27 as soon as possible to mitigate the vulnerabilities.