cyber.hendryadrian.com
Vulnerability & Exploit · cyber.gc.ca

Canada Warns of Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

· Original article ↗

Summary

Canada’s Cyber Centre warns that two PHP use-after-free vulnerabilities could allow unauthenticated code execution. A PoC is reportedly available, but no active exploitation had been identified; organizations should update affected installations and prioritize internet-

Key points

  • CVE-2026-109618 and CVE-2026-109619 are use-after-free vulnerabilities (CWE-416) affecting multiple PHP versions.
  • Successful exploitation could let an unauthenticated attacker execute arbitrary code; internet-facing PHP servers and applications face heightened risk.
  • The Cyber Centre says open-source reporting indicates a proof of concept is available, but it had not identified active exploitation as of the advisory update.
  • The PHP Security Team has released security updates; organizations should upgrade affected installations to a fixed, supported release.
  • The advisory identifies PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed deployments as at risk, and says mod_php has the greatest risk.
  • Prioritize internet-facing systems and applications processing untrusted input; identify vulnerable PHP bundled in third-party products, appliances and containers.
  • If patching is delayed, consider isolating internet-facing applications and monitor logs and systems for suspicious activity.

Article Details

Vulnerability Types
  • Use After Free (CWE-416)
Severity
Critical
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • If immediate remediation is not feasible, isolate internet-facing applications from public networks until a fix can be applied.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationA demonstrated exploit uses an unauthenticated request to trigger the PHP vulnerability on affected, internet-facing servers.

Vendors

PHP projectNote: versions 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.

Products

ApacheAll PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. PHP assess the risk as greatest for mod_php, as a demonstrated exploit allows anFrankenPHPAll PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. PHP assess the risk as greatest for mod_php, as a demonstrated exploit allows anLiteSpeedPHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. PHP assess the risk as greatest for mod_php, as a demonstrated exploit allows anPHPvulnerabilities are Use After Free vulnerabilities (CWE-416)Footnote 5 affecting multiple versions of PHP. Known as “php2shell”Footnote 6, successful exploitation could allow an unauthenticated threat actor to

Related Articles