CERT24Serious vulnerabilities in PHP: prepare for patchingLoading data…
CERT24Threat Observatory
Period

Serious vulnerabilities in PHP: prepare for patching

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been found in PHP. They may enable remote code execution (RCE) and could result in web servers being taken over, websites becoming inaccessible, or data being leaked. Public PoC code is available, but the NCSC has not observed active exploitation.

← Back to intelligence

Serious vulnerabilities in PHP: prepare for patching

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been found in PHP. They may enable remote code execution (RCE) and could result in web servers being taken over, websites becoming inaccessible, or data being leaked. Public PoC code is available, but the NCSC has not observed active exploitation.