What Happened

On October 21, 2026, the European Commission, ENISA, CERT-EU, Europol's European Cybercrime Centre and the EU CSIRTs network issued a coordinated warning about two critical flaws in PHP. The issues are tracked as CVE-2026-109618 and CVE-2026-109619. PHP is widely used to run server-side website and application features. The PHP project released updates on October 21, with further version-specific information in its official release notes.

Technical Context

The agencies warn that an attacker may, under affected conditions, be able to run malicious code remotely without first authenticating. That possibility raises the stakes for public-facing web applications. Exposure depends on specific PHP builds and configurations: administrators should not infer that every PHP-powered website is equally vulnerable. The correct patched version must be identified from the official PHP advisory and, where appropriate, the hosting provider's update guidance.

Who Needs To Act

The risk extends beyond teams that write PHP themselves. A commercial portal, content-management system or packaged service may include PHP as a dependency, making the underlying runtime important even when the organisation's own software inventory does not mention it. ENISA specifically recommends coordinating with hosting providers and checking products that embed PHP.

Recommended Action

Identify servers and managed applications using affected PHP builds. Prioritise internet-facing assets and apply vendor-provided fixed versions. Where an immediate update cannot be applied, assess whether the affected application can be isolated from public networks until remediation is complete. Monitor for unexpected server-side execution and preserve relevant access logs where an intrusion is suspected. Keep a record of third-party products and service providers consulted.

What Is And Is Not Known

The European warning describes serious exploitation potential, not proof that every affected system has been attacked. Detailed version ranges and patch instructions should be taken directly from the PHP project and vendors, not extrapolated from the CVE IDs.