PHP: two critical vulnerabilities, fixes expected October 21

On October 20, 2026, the PHP project announced a security release for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. This is reported by advisory 2026-018 from CERT-EU, the cybersecurity service for the institutions, bodies and agencies of the European Union. According to CERT-EU, which cites the announcement on the PHP website and some unofficial reports, the two flaws could lead to remote code execution (RCE).

The release is scheduled for October 21, 2026 at 14:00 UTC (16:00 in Central Europe). Until then no technical details are public: this article covers what is known today and how to prepare, and should be read together with the PHP release notes once they are published.

What we know

• CVEs: CVE-2026-109618 and CVE-2026-109619.
• Severity: a CVSS score of 9.2 for both. According to CERT-EU, these scores indicate the potential for unauthenticated remote code execution.
• Affected versions: according to CERT-EU, citing an unofficial source, the vulnerabilities could affect all PHP versions from PHP 5 onwards. This has not been confirmed by the PHP project.
• Technical details: none. The affected component, the exact attack vector and the required conditions (extensions, configurations, execution modes) are unknown.
• Exploitation: the advisory mentions neither active exploitation nor public exploits, and lists no indicators of compromise.

The CERT-EU advisory is the only source for this article: all information is attributed to it and to the sources it cites.

Why it matters for European and Italian companies

PHP is the server-side language behind a huge number of websites and web applications: CMSs, online shops, customer and supplier portals, business software with a web interface. It runs on dedicated servers, in shared hosting and inside container images, often managed by different providers.

This is why CERT-EU urges organisations to prepare before the fixes are published, so they can update as soon as they are available. Until then nobody can say for certain which installations are actually vulnerable: the inventory is there precisely so that no time is lost afterwards.

For entities in scope of NIS2, this falls under vulnerability management: it is worth documenting the inventory of systems running PHP, the assigned priority and the update timeline. Any significant incident must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN). In healthcare, PHP may power patient portals and online booking services: include them in the inventory.

What to do now

CERT-EU recommends identifying PHP-based applications and preparing to update them as soon as fixed versions are available. Where immediate remediation is not feasible, it advises considering isolating internet-facing applications from public networks until the fix can be applied.

In practice:

1. Take inventory of where PHP runs: web servers, containers, hosting, third-party applications. php -v shows the version of the command-line interpreter; the one used by the web server (PHP-FPM or server module) may differ and must be checked separately.
2. Prioritise internet-facing systems, starting with applications reachable without authentication.
3. Plan the maintenance window for October 21 after 14:00 UTC, with testing and a rollback plan.
4. Know where your update comes from: if you use Linux distribution packages, a hosting control panel or container images, the fixed versions come from them, possibly on different timelines. Follow their advisories as well as PHP’s.
5. Check which branches are still supported on the supported versions page at php.net and, for those out of support, check with the project or your provider whether a fix is planned.
6. If you cannot update right away, consider, as CERT-EU suggests, removing applications from public exposure, for example by restricting access to the VPN or to authorised addresses.
7. After the release, read the PHP security notes to learn which components and configurations are affected, update, and review web server logs for anomalous requests.

How ARXDOME helps

ARX Sentry’s inventory lists the software, processes and ports of every server with the agent, helping you find where PHP and PHP-FPM are installed. ARX Shield shows open vulnerabilities by machine and by package, while ARX Expose shows your company’s public services and the products identified on them: together they help you decide which servers to start with.

Last updated: 20 October 2026