Join us at the DPSC on Oct 21: https://streamscan.link/DPSC2026
Two critical security vulnerabilities affecting PHP were addressed in patches released on October 21, 2026. Identified as CVE-2026-109618 and CVE-2026-109619, each carries a CVSS v4.0 criticality score of 9.2 out of 10 and could allow for remote code execution on vulnerable servers.
These vulnerabilities require immediate attention from organizations operating PHP-based web applications and services, particularly when these environments are accessible from the internet.
PHP is a programming language widely used in web development. It serves as the foundation for numerous applications and content management platforms, including WordPress.
The CVE-2026-109618 and CVE-2026-109619 vulnerabilities could allow a remote attacker, without prior authentication, to execute arbitrary code on a vulnerable server. Such exploitation could compromise the security of the affected systems and, depending on their configuration and the privileges associated with the PHP processes, lead to significant consequences for organizations.
With a CVSS score of 9.2 out of 10 for each of these vulnerabilities, patching them should be considered a priority.
The vulnerabilities affect unpatched PHP installations that process web requests, including the following environments: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed.
Particular attention should be paid to Apache environments using mod_php, for which the risk level is particularly high.
Organizations operating websites or applications based on PHP, including WordPress, must also verify their installed versions and applied patches. It is important to emphasize that using WordPress does not automatically mean a site is vulnerable. The level of exposure depends primarily on the version of PHP being used and the status of security updates.
In the face of these critical vulnerabilities, organizations must act quickly to reduce their exposure.
1. Identify affected PHP installations
Conduct an inventory of environments using PHP and prioritize identifying services accessible from the internet.
2. Apply security patches
Update PHP to the patched version corresponding to your current branch (8.2.35, 8.3.36, 8.4.27, or 8.5.12).
If PHP is provided by a distributor, apply the equivalent security patch they have made available. For environments using PHP 8.1 or earlier, check with your vendor for patch availability and plan a migration to a supported version.
3. Implement temporary mitigation measures
If an immediate update is not possible, temporarily restrict access to the affected services and consult the mitigation measures published by PHP.
These measures can help reduce exposure but do not replace the need to apply the patches.
4. Verify that updates have been applied:
Ensure that the patches have been correctly deployed across all affected servers and instances, including secondary environments.
5. Strengthen environment monitoring:
Pay close attention to web and system logs to identify any signs of suspicious activity
Releasing patches is a critical step, but their rapid deployment and ongoing monitoring of environments remain essential to limiting risk.
At StreamScan, our Managed Detection and Response (MDR) teams continue to monitor covered environments to identify any suspicious activity potentially associated with these vulnerabilities.
When facing critical vulnerabilities, the ability to quickly detect abnormal behavior and intervene effectively plays a decisive role in protecting organizations.
Do you think your environments might be exposed to these vulnerabilities, or have you detected suspicious activity? Contact our team.
