Skip to content
Critical Security Flaws in Oracle PHP Versions Prompt Urgent Updates

Critical Security Flaws in Oracle PHP Versions Prompt Urgent Updates

First seen 23 Oct 2026, 12:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 24, 2026 at 12:12 UTC
  • •Critical vulnerabilities in Oracle PHP 8.2, 8.3, and 8.4 require immediate patching.
  • •CVE-2026-109618 has a CVSS score of 9.2, indicating a severe risk of remote code execution.
  • •Proof-of-concept code for the vulnerabilities was made public on October 22, 2026.

Oracle has released important security updates for PHP versions 8.2, 8.3, and 8.4 due to critical vulnerabilities, including CVE-2026-109618, which has a CVSS score of 9.2. These flaws could allow for remote code execution, affecting self-managed GitLab instances. The updates were published on October 22, 2026, and administrators are urged to apply them immediately. The vulnerabilities were disclosed shortly after the publication of a proof-of-concept (PoC) on October 22, 2026. Other vulnerabilities, such as CVE-2026-91765, also require attention but are rated lower at 7.5. The affected systems include Oracle Linux 10 and various PHP modules. The urgency is heightened by the potential for exploitation in the wild, as indicated by the recent PoC release.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-09-25
CVE-2026-91765 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Oracle disclosed a critical vulnerability in PHP with a CVSS score of 9.2, allowing remote code execution.
Linuxsecurity
2026-10-22
PoC released
A proof-of-concept for CVE-2026-109618 was published, increasing the risk of exploitation.
Linuxsecurity
2026-10-22
Security updates released
Oracle released important updates for PHP versions 8.2, 8.3, and 8.4 to address critical vulnerabilities.
Linuxsecurity

More articles in this cluster (5)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 2

Common questions

Which PHP versions are affected?
The vulnerabilities affect Oracle PHP versions 8.2, 8.3, and 8.4.
How urgent is the patching process?
Patching is urgent due to the critical nature of the vulnerabilities and the availability of a public PoC.
What steps should I take to mitigate the risk?
Administrators should apply the latest updates immediately to mitigate the risk of exploitation.