Critical PHP Vulnerabilities Under Active Exploitation

Threat Notice

Two critical vulnerabilities affecting PHP have been announced, tracked as CVE-2026-109618 and CVE-2026-109619. The vulnerabilities may allow unauthenticated remote code execution (RCE) on affected servers, providing attackers with the ability to execute arbitrary code without valid credentials.

PHP is widely used to support websites, web applications, APIs, and other internet-facing services. The NCSC has advised that it is aware of reports of active exploitation and is encouraging affected organisations to apply vendor-provided updates immediately.

Given the prevalence of PHP-based applications and the potential impact of successful exploitation, organisations should assess exposure as a priority and apply remediation without delay.

01. What Happened?

PHP has released security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. According to the NCSC, successful exploitation could allow unauthenticated remote code execution against affected systems.

The vulnerabilities affect PHP installations serving web requests, including:

• PHP-FPM
• Apache with mod_php
• php-cgi
• FrankenPHP
• LiteSpeed

The Australian Cyber Security Centre (ACSC) notes that PHP has published advance notice of the vulnerabilities and that affected versions may extend broadly across PHP deployments.

02. Why Does This Matter?

Remote code execution vulnerabilities affecting internet-facing web infrastructure present a significant risk due to the potential for:

• Initial compromise of publicly accessible systems
• Webshell deployment and persistence
• Credential theft
• Lateral movement within internal environments
• Service disruption
• Ransomware deployment

While technical details remain limited, active exploitation reporting significantly increases the likelihood that threat actors will rapidly weaponise available information once public exploit techniques become understood.

Organisations operating externally accessible PHP applications should assume that opportunistic scanning and exploitation activity may increase following public disclosure.

03. What Can You Do?

Identify Affected Systems

Identify all systems utilising PHP, particularly internet-facing applications, websites, APIs, and externally accessible services.

Apply Security Updates

Update affected systems to the vendor-recommended versions:

Assess Embedded Dependencies

Review appliances, edge devices, firewalls, and other products that may utilise embedded PHP implementations. These may require separate patching processes and vendor-specific remediation guidance.

Investigate Signs of Compromise

Investigate for indications of unauthorised access or compromise of affected products.
Particular attention should be given to:

• Unexpected PHP file modifications
• New administrative accounts
• Suspicious outbound network activity
• Unrecognised webshells or scripts
• Authentication anomalies

Enhance Monitoring

Review monitoring and detection coverage for internet-facing web infrastructure and PHP-hosted applications. Organisations should maintain heightened visibility until patching activities have been completed across all affected environments.

04. Further Information

NCSC New Zealand Alert

• CVE-2026-109618 and CVE-2026-109619 affecting PHP

ASD ACSC Alert

• Critical Vulnerabilities in PHP
• Upcoming Critical PHP Security Release