Joint statement on critical PHP vulnerabilities

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to remotely execute malicious code on vulnerable servers without authentication. The PHP security team issued updates on 21 October 2026 at 13:40 UTC. Full technical details of these updates, as well as the affected and the fixed versions accompany the release.

PHP security advisory can be found at: https://www.php.net/archive/2026.php

Organisations should identify their PHP-based applications, coordinate with hosting and service providers, and apply the released security updates. Prioritise internet-facing systems. Where immediate remediation is not feasible, consider isolating exposed applications from public networks until fixes can be applied. 

Many commercial and open-source products rely on PHP in the background. As a result, some may be affected by these vulnerabilities even if they do not appear to use PHP directly. We recommend checking the NCSC-NL GitHub repository for information on third-party software that includes PHP and may be impacted: https://github.com/NCSC-NL/php2shell 

The latest advisories published by CSIRTs Network members can be found in their relevant official communication channels. Organisations may also refer to guidance given by CERT-EU. ENISA maintains an advisory collection under: https://github.com/enisaeu/CNW/blob/main/advisories/2026/CNW-2026-04_php.md 

ENISA and all relevant EU actors will continue to monitor this threat to contribute to the overall situational awareness at the Union level.

EU Policy

Organisations should be further aware that as of 11 September 2026, manufacturers of hardware and software products must report actively exploited vulnerabilities through the CRA Single Reporting platform, in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act). More information is available at: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting  and https://www.enisa.europa.eu/topics/product-security/vulnerability-services/eu-incident-response-and-cyber-crisis-management/single-reporting-platform-srp 

The Cyber Resilience Act (CRA) main cybersecurity requirements will apply as of 11 December 2027. These will require manufacturers of hardware and software products (‘products with digital elements’) to implement security-by-design and ensure security support during the lifecycle of such products, including the remediation of vulnerabilities without delay.