Critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619

On October 21, 2026, the PHP Group disclosed two critical vulnerabilities: 

• CVE-2026-109618
• CVE-2026-109619

Both vulnerabilities allow an unauthenticated attacker to execute code remotely on affected systems. 

Advisories and recommendations

Cybersecurity and Infrastructure Security Agency (CISA) and the Computer Emergency Response Team for the European Union institutions, bodies and agencies (CERT-EU) recommend patching affected systems immediately. CERT-EU also lists configuration changes to reduce exposure.

For more information, see the following links: 

• CISA alert
• CERT-EU security advisory

How to identify endpoints with PHP

Use the Software Inventory page to identify endpoints with PHP installed:

1. Log in to Nebula or OneView.
2. Go to Monitor > Software Inventory.
3. In the Application column, filter for PHP.

4. If the endpoint is running one of the following branches, update it to the latest version.

   PHP branch	Upgrade to version
   8.5	8.5.12
   8.4	8.4.27
   8.3	8.3.36
   8.2	8.2.35
   Versions earlier than 8.2	Upgrade to a higher branch and the latest version

ThreatDown products impact statement

ThreatDown products are not affected by these PHP CVEs.