Operational information: 21 October 2026 17:25 CEST
Software list last status update: 26 October 2026 03:24 CET
This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619.
PHP is a widely used open-source server-side scripting language, so these vulnerabilities may affect a broad range of internet-facing web applications and products that embed or depend on PHP.
On 21 October 2026, PHP published fixed releases for CVE-2026-109618 and CVE-2026-109619: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP states that both vulnerabilities can allow unauthenticated remote code execution and that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, where an unauthenticated request can trigger exploitation before application code runs.
PHP describes CVE-2026-109618 as remote code execution via out-of-memory corruption during request cleanup, and CVE-2026-109619 as remote code execution via stale request-owned global state reused by a later request on the same worker. PHP 8.1 and older are no longer supported by the PHP project; distributions and LTS vendors may provide backported packages, and PHP has published minimal source backports for PHP 7.4, 8.0 and 8.1.
The impact is not limited to websites: PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly.
- Identify PHP-based applications and their runtime versions, with priority on internet-facing systems and web-serving SAPIs.
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply vendor-provided backported packages.
- Check third-party images, appliances and embedded runtimes separately; for products that bundle PHP, apply vendor updates as soon as they become available.
- If immediate patching is not possible, follow PHP's temporary mitigations, including disabling
session.upload_progress, restarting workers, and reviewing the officialmemory_limit,post_max_sizeand PHP 8.5fatal_error_backtracesguidance. PHP states that these measures are not complete fixes. - Monitor vendor advisories, internet-facing logs, and public exploit activity.
For additional information see:
- CERT-EU Security Advisory 2026-018
- PHP security advisory: Critical remote code execution vulnerabilities, update now
- List of advisories from other EU national CSIRT's
| Directory | Purpose |
|---|---|
| detection_mitigation | Contains detection and mitigation material for the vulnerabilities. |
| software | Contains inventory lists of software products with a PHP dependency potentially affected by the vulnerabilities. |
| tools | Contains tools for using/generating files within this repo |
The repository is being updated as the situation develops. Check back for updates.
| Date and time | Supplier | Product | Version (see Status) | Status CVE-2026-109618 / CVE-2026-109619 | Links |
|---|---|---|---|---|---|
| 2026-10-26 03:24:33 +0100 | GetPageSpeed | GetPageSpeed PHP 5.6-8.4 backport packages for CentOS 7 / EL7 | Known patched EL7 builds: 5.6.40-44.el7; 7.0.33-46.el7; 7.1.33-35.el7; 7.2.34-30.el7; 7.3.33-26.el7; 7.4.33-35.el7; 8.0.30-25.el7; 8.1.34-8.el7; 8.2.35-2.el7; 8.3.36-2.el7; 8.4.27-3.el7 | Fix | source 1 source 2 source 3 |
| 2026-10-26 03:19:07 +0100 | Broadcom | CloudSOC Cloud Access Security Broker (CASB) | CloudSOC CASB service; excludes the separate SpanVA appliance | Not vuln | source |
| 2026-10-26 03:19:07 +0100 | Cisco | Cisco Catalyst Center (formerly DNA Center) | Vendor-confirmed not vulnerable product scope | Not vuln | source |
| 2026-10-26 03:19:07 +0100 | Cisco | Cisco CX Cloud | Vendor-confirmed not vulnerable product scope | Not vuln | source |
| 2026-10-26 03:19:07 +0100 | Cisco | Cisco IoT Control Center | Vendor-confirmed not vulnerable product scope | Not vuln | source |
See the full software status update history.
If you have any additional information to share relevant to these PHP vulnerabilities, feel free to open a Pull request. New to this? Read how to contribute in GitHub's documentation.
For updates to the software list: our strong preference is to receive edits in the SPDX source files in software/spdx/. The Markdown list pages are generated automatically from those files. In case this proves too difficult: don't worry. We'll attempt to backport edits in the .md files to the SPDX source files, but without any guarantees.