Critical PHP vulnerabilities allow remote execution

The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has issued an alert after the PHP Foundation provided advanced notice of two critical vulnerabilities in PHP.

The ACSC said PHP is widely used in web applications and that the alert is aimed at technical teams responsible for network security, asset management and system administration across sectors, as well as people operating PHP workloads, websites and applications.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carry a critical CVSS score of 9.2 and could allow unauthenticated attackers to remotely execute malicious code on vulnerable web servers without requiring login credentials.

The vulnerabilities affect multiple PHP deployment environments, including Apache mod_php and PHP-FPM. Researchers have already demonstrated successful exploitation,

The ACSC advised organisations and individuals to identify where PHP is used in their environments, monitor official PHP guidance, prepare to apply security patches when they become available, and monitor PHP applications and associated environments for potentially malicious activity.

PHP Security Release page at https://www.php.net/index.php#2026-10-20-1 and further information is available on its website at https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts