Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
17:01 UTC: Monitoring for signs of exploitation
The following behaviors and changes may indicate exploitation of these vulnerabilities:
- Network sessions that last longer than usual (Applications running on the PHP service should have a standard pattern of network connections.)
- Unusual process names (including misspellings of legitimate names), or seemingly legitimate processes in unexpected locations
- Unusual and low-volume inbound traffic from low-reputation infrastructure
14:28 UTC: Revised version of the original advisory (published at approximately 12:55 UTC) following PHP’s release of updates and additional details
On October 20, 2026, PHP announced an upcoming security release to address two critical (CVSS score of 9.2) vulnerabilities. Third-party sources identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. According to reports, the issues impact multiple PHP versions and allow for remote code execution.
On October 21, PHP released updated versions to address these issues and stated that “all PHP installations serving web requests” are at risk. A user on the X platform claims to have created a working proof-of-concept exploit. As of this publication, active exploitation has not been reported in the wild.
Recommended actions
Counter Threat Unit™ researchers recommend that customers identify potentially vulnerable systems and upgrade as appropriate. In the interim, organizations should consider taking internet-facing PHP-powered systems offline if feasible or putting them behind network-layer authentication (e.g., ZTNA). Additionally, network defenders should evaluate the potential for exploitation in their environment and monitor for suspicious activity. The PHP advisory lists mitigations for organizations who cannot immediately upgrade but notes that updating is the only complete solution.
Sophos countermeasures
SophosLabs continues to monitor the threat landscape for activity related to these vulnerabilities and will deliver detections and protections as available. An internal investigation is also underway to determine if Sophos products or services are affected.
About Author
