Skip to content
Critical PHP Vulnerabilities Prompt Urgent Security Response

Critical PHP Vulnerabilities Prompt Urgent Security Response

First seen 23 Oct 2026, 11:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 13:12 UTC
  • •Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) disclosed on October 21, 2026.
  • •Vulnerabilities could allow remote code execution, affecting millions of websites worldwide.
  • •Emergency patches released, but many sites remain unpatched and vulnerable.

On October 21, 2026, two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed, affecting millions of websites globally. These flaws could allow remote code execution, enabling attackers to control servers without authentication. The National Cyber Security Centre (NCSC) has reported initial signs of exploitation, urging immediate patching of affected systems. PHP is widely used, powering around 70% of the internet, making the impact potentially large. Emergency patches were released on October 22, 2026, but many websites remain unpatched. Organizations, including banks and property technology firms, have taken their websites offline as a precaution. The situation is evolving, with the NCSC warning that AI could facilitate faster exploitation of these vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
PHP Foundation disclosed two critical vulnerabilities allowing remote code execution.
The Hindu
2026-10-22
First public PoC released
Proof-of-concept code for CVE-2026-109619 was made public, increasing urgency for patching.
Harrogatechamber
2026-10-22
Emergency patches released
PHP released emergency updates to address the critical vulnerabilities, urging immediate installation.
NL Times
2026-10-23
Initial exploitation reports
NCSC reported initial signs of hackers exploiting the PHP vulnerabilities, urging immediate action.
NL Times

More articles in this cluster (7)

Following this threat?

Track CVE-2026-107891 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 2

Common questions

Which versions of PHP are affected?
All versions of PHP are potentially affected, including newer installations.
What should organizations do immediately?
Organizations should apply the emergency security patches released for PHP without delay.
Are there confirmed cases of exploitation?
Yes, the NCSC has reported initial signs of exploitation of the vulnerabilities.