FBI Urges Immediate Patching of Two Critical PHP Core Vulnerabilities
Summary
The FBI warns that CVE-2026-109618 and CVE-2026-109619 could enable remote code execution in PHP Core. It urges organizations to update affected installations, or take systems offline until mitigated, and monitor for suspicious activity.
Key points
- The FBI says CVE-2026-109618 and CVE-2026-109619 could allow malicious actors to remotely execute code in PHP Core.
- Security updates are available; organizations should inventory PHP deployments and prioritize internet-facing systems and vendor products bundling PHP.
- If an immediate update is not feasible, the FBI recommends taking affected systems offline until they are fully mitigated.
- Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files.
- If compromise is suspected, isolate affected systems, preserve web server and PHP logs, and report the findings to the FBI or www[.]ic3[.]gov.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- If an immediate update is not feasible, take the affected system offline until it can be fully mitigated.
CVE
CVE-2026-109618These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.CVE-2026-109619These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.