What is CVE-2026-109618 & CVE-2026-109619?
CVE-2026-109618 & CVE-2026-109619 are reported Remote Code Execution vulnerabilities in PHP, a scripting language used to build and run web applications and websites. According to an unverified report, the vulnerability would let an attacker run their own code on a server running PHP, potentially taking control of it. The report describes it as affecting every PHP version from PHP 5 onward, though no official vendor advisory has confirmed the scope, the technical cause, or a fixed version.
| CVE | Description | CVSS | Exploited in the wild |
|---|---|---|---|
| CVE-2026-109618 | Remote Code Execution in PHP | Not yet scored | Not reported |
Is CVE-2026-109618 & CVE-2026-109619 being exploited in the wild?
As of October 21, 2026, no exploitation in the wild has been reported.
How did CVE-2026-109618 & CVE-2026-109619 come to light?
Information leaked on social media that indicated a security announcement covering two PHP remote code execution vulnerabilities, including CVE-2026-109618 & CVE-2026-109619, was scheduled for October 22, 2026, at 18:00 CEST. The poster said the claim rested solely on trust in that source and had not been independently confirmed at the time of posting.
How is watchTowr helping PHP customers?
- Adversary Sight engine identified PHP instances across client environments and assessed exposure.
- Rapid Reaction identified exposure to this vulnerability across the watchTowr client base, giving teams the time they need to act.
What is PHP?
PHP is a scripting language used to build dynamic websites and web applications. Enterprise networks commonly run PHP-based content management systems and internal tools, so servers running PHP often handle customer data and business logic reachable from the internet.
Which PHP versions are affected?
| Product | Affected Versions | Fixed Version |
|---|---|---|
| PHP | 5, 6, 7 8 | [to be confirmed] |
- The report claims the vulnerability affects every PHP version from PHP 5 onward, though this scope has not been confirmed by an official vendor advisory.
- No specific configuration or feature requirement has been described in the available report.
Until PHP publishes an official advisory, security teams cannot determine which specific deployments face the greatest exposure; every organization running PHP in production should prepare to act quickly once a fix is confirmed.
How do I fix CVE-2026-109618 & CVE-2026-109619?
No vendor advisory or fixed version exists yet, so there is no confirmed patch or workaround at this time. Security teams should watch for the official PHP security announcement and apply the fixed version promptly once it becomes available.
- Monitor official PHP security channels for the scheduled vendor announcement.
- Inventory every server and application that runs PHP in production.
- Avoid acting on unverified reports until an official advisory confirms the details.
- Prepare a rapid update process for PHP installations ahead of a confirmed fix.
- Apply the vendor’s fixed PHP version promptly once it is released.
What other vulnerabilities does the same bulletin fix?
The same announcement is reported to also include CVE-2026-109619, a second PHP remote code execution vulnerability that the same unverified report describes as affecting every version from PHP 5 onward.
What types of threat actors typically exploit this vulnerability?
No attribution has been made public.
