{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2026-018.pdf"
    },
    "title": "Critical Vulnerabilities in PHP",
    "serial_number": "2026-018",
    "publish_date": "20-10-2026 20:33:27",
    "description": "On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks.<br>\nAt this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available.<br>\nThe PHP team has scheduled the release for 21 October 2026 at 14:00 UTC.<br>\n",
    "url_title": "2026-018",
    "content_markdown": "---    \ntitle: 'Critical Vulnerabilities in PHP'\nnumber: '2026-018'\nversion: '1.0'\noriginal_date: '2026-10-20'\ndate: '2026-10-21'\n---\n\n_History:_\n\n* _21/10/2026 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks [1,2,3].\n\nAt this time, no technical details have been made public. CERT-EU advises organisations to prepare for **immediate patching of affected assets**. Where immediate patching is not feasible, organisations should **consider isolating internet-facing applications from public networks until a fix is available**.\n\nThe PHP team has scheduled the release for 21 October 2026 at 14:00 UTC [1].\n\n# Technical Details\n\nNo technical details are currently available for **CVE-2026-109618** and **CVE-2026-109619**, apart from their CVSS scores of 9.2, which indicate the potential for unauthenticated remote code execution [1].\n\n# Affected Products\n\nThese vulnerabilities could affect all PHP versions from PHP 5 onwards [2]. \n\n# Recommendations\n\nCERT-EU strongly recommends identifying PHP-based applications and preparing to **patch as soon as fixed versions become available**. Where immediate remediation is not feasible, organisations should **consider isolating internet-facing applications from public networks until a fix can be applied**.\n\n# References\n\n[1] <https://www.php.net/archive/2026.php#2026-10-20-1>\n\n[2] <https://cyberplace.social/@GossiTheDog/117474220875882526>\n\n[3] <https://x.com/watchtowrcyber/status/2112611507749982605>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>21/10/2026 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks [1,2,3].</p><p>At this time, no technical details have been made public. CERT-EU advises organisations to prepare for <strong>immediate patching of affected assets</strong>. Where immediate patching is not feasible, organisations should <strong>consider isolating internet-facing applications from public networks until a fix is available</strong>.</p><p>The PHP team has scheduled the release for 21 October 2026 at 14:00 UTC [1].</p><h2 id=\"technical-details\">Technical Details</h2><p>No technical details are currently available for <strong>CVE-2026-109618</strong> and <strong>CVE-2026-109619</strong>, apart from their CVSS scores of 9.2, which indicate the potential for unauthenticated remote code execution [1].</p><h2 id=\"affected-products\">Affected Products</h2><p>These vulnerabilities could affect all PHP versions from PHP 5 onwards [2]. </p><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU strongly recommends identifying PHP-based applications and preparing to <strong>patch as soon as fixed versions become available</strong>. Where immediate remediation is not feasible, organisations should <strong>consider isolating internet-facing applications from public networks until a fix can be applied</strong>.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.php.net/archive/2026.php#2026-10-20-1\">https://www.php.net/archive/2026.php#2026-10-20-1</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://cyberplace.social/@GossiTheDog/117474220875882526\">https://cyberplace.social/@GossiTheDog/117474220875882526</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://x.com/watchtowrcyber/status/2112611507749982605\">https://x.com/watchtowrcyber/status/2112611507749982605</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}