PHP has released security updates addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities are rated Critical, with a CVSS v4.0 score of 9.2. They could allow unauthenticated remote attackers to execute malicious code on affected servers.

Affected Systems

The following system versions are affected:

• PHP 8.5: versions before 8.5.12

• PHP 8.4: versions before 8.4.27

• PHP 8.3: versions before 8.3.36

• PHP 8.2: versions before 8.2.35

• PHP 8.1 and earlier: These versions are also affected.

Security Risks

The identified critical vulnerabilities could allow attackers to execute malicious code on affected servers without authentication or access sensitive information, including passwords and other credentials. Successful exploitation could compromise affected servers, websites, and web applications.

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and system administrators to:

1. Update PHP to a fixed version as soon as possible to address the identified critical vulnerabilities and protect affected servers from potential exploitation.

The recommended software versions to upgrade to are as follows:

• PHP 8.5: Upgrade to version 8.5.12 or above

• PHP 8.4: Upgrade to version 8.4.27 or above

• PHP 8.3: Upgrade to version 8.3.36 or above

• PHP 8.2: Upgrade to version 8.2.35 or above

• PHP 8.1 and earlier: Upgrade to a supported version or check with the relevant vendor for available security fixes.

2. Before performing any update tasks, ensure that you have a backup of your data.

For further information and support, please contact the National Cyber Security Authority (NCSA) by emailto rwcsirt@ncsa.gov.rw or call us on 9009

References

• PHP Security Advisory

• PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

• PHP warns admins of two critical flaws, emergency patches coming tomorrow