Vulnerability

PHP announces security update for two critical vulnerabilities

On 20 October 2026, the PHP security team announced a security update addressing two critical vulnerabilities in PHP. The release is scheduled for Wednesday, 21 October 2026, at 14:00 UTC.

Clip path group@2x

T-Update

Information about vulnerabilities

This live blog contains information regarding two critical vulnerabilities in PHP.
‍

Update 21 October 2026 13:30

Tesorion advises that, as a precaution, publicly accessible websites and web applications using PHP should be taken offline as soon as possible until it is clear whether they are vulnerable and the necessary security updates have been applied.

Work with your hosting provider or administrator to identify which websites and applications use PHP. Prepare for the installation of security updates so that they can be applied immediately upon release. The release is scheduled for today at 16:00 Dutch time.

 Tesorion Immunity does not use PHP. These vulnerabilities are therefore not applicable to Immunity.

 As a precaution, Tesorion has also temporarily taken the customer portal offline. Consequently, the portal is currently unavailable.
‍

Update 21 October 2026 12:00

On 20 October 2026, the PHP security team announced a security update for two critical vulnerabilities in PHP. The release is scheduled for Wednesday, 21 October 2026, at 14:00 UTC. Following this announcement and leaked information, CERT-EU has published an advisory. PHP is widely used for web applications, including WordPress, Drupal, and Magento.

The American company Cloudflare, which acts as a firewall for many popular websites, is now seeing the first attacks. Cloudflare’s firewall is blocking attempts to exploit the vulnerability, the company stated via ‘X’.

Tailored cybersecurity

Background

The PHP security team has reported two critical vulnerabilities, both carrying a CVSS v4.0 score of 9.2. The vendor will only publish technical details, affected versions, and patched versions upon release. CERT-EU and Cyber Kendra have linked the vulnerabilities to CVE-2026-109618 and CVE-2026-109619; both CVEs currently remain in "reserved" status. It is not yet known which configurations leave a system vulnerable. According to Cyber Kendra, none of the reports specify the affected function, extension, or configuration. Affected versions: According to the vendor: will be published upon release. According to CERT-EU, based on a report by researcher Kevin Beaumont: potentially all PHP versions from PHP 5 onwards. Affected versions: According to the vendor: will be published upon release. According to CERT-EU, based on a report by researcher Kevin Beaumont: potentially all PHP versions from PHP 5 onwards.

Risk

PHP has rated both vulnerabilities as critical, with a CVSS v4.0 score of 9.2, though it has yet to describe what an attacker could do with them. CERT-EU and watchTowr have pointed to remote code execution. CERT-EU infers from the score that this is possible without authentication. watchTowr confirms that the leaked information relates to genuine vulnerabilities: “We can confirm that they’re real.”

Advice

  • Map your PHP applications and versions and determine which PHP version is running.
  • Prepare for the update now. PHP is urging all users to prepare so that the upgrade can be carried out as soon as the release is available.
  • Install the update as soon as it becomes available.
  • Consider isolation if immediate patching is not possible. Consider shielding internet-facing applications from public networks until a fix has been applied.
    ‍
  • Haal publiek toegankelijke websites en webapplicaties die PHP gebruiken uit voorzorg zo snel mogelijk tijdelijk offline, totdat duidelijk is of deze kwetsbaar zijn en de benodigde beveiligingsupdates zijn doorgevoerd.
  • Plan the migration from PHP 5 and PHP 7 to a supported PHP 8 version.  

Do you have questions about the potential impact on your environment, or do you require support? Please contact T-CERT.

‍

Sources

Ellipse 6

Sign up for T-Updates

Receive the latest news about malware or vulnerabilities in your inbox every Wednesday

More than 1,000 organizations have already joined us.

Tesorion uses your data to send the requested information. In addition, your data may be used for commercial follow-up. You can unsubscribe from this at any time via the link in the email. For more information, read our privacy policy.

Ellipse 6