Critical PHP flaws expose websites to cyberattacks

Two critical security vulnerabilities in PHP, a programming language widely used to power websites, could allow hackers to remotely execute malicious code on vulnerable servers without logging in, cybersecurity researchers have warned.

Tenable Research has classified the flaws, identified as CVE-2026-109618 and CVE-2026-109619, as Vulnerabilities of Concern, its highest severity designation under its Vulnerability Watch program.

Satnam Narang, senior staff research engineer at Tenable, warned that the widespread use of PHP makes the vulnerabilities particularly significant.

Estimates suggest that nearly 70 percent of websites with a known server-side programming language use PHP, although the figure does not indicate how many run vulnerable versions.

The flaws affect PHP itself rather than a specific website application, potentially exposing content management systems, business platforms and other web services.

If exploited, they could allow attackers to execute code remotely without authentication. CVE-2026-109619 could also expose information stored in server memory.

Narang described the vulnerabilities as among the most consequential since Log4Shell, a major software security flaw disclosed in 2021.

The vulnerabilities were discovered with artificial intelligence assistance, reflecting the growing role of such tools in cybersecurity research.

Their disclosure was also accelerated after vulnerability identifiers leaked ahead of the planned announcement.

According to Narang, the PHP Foundation had not identified functional exploits at the time of release, although subsequent reports indicated exploitation attempts.

The PHP development team issued security updates on 21 October 2026 and urged administrators to upgrade immediately.

Affected installations should be updated to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or later supported versions.

Narang warned that patching could take longer for organizations using outdated software or applications that bundle PHP, as administrators may need to wait for vendors to release compatible updates.

Linux distributions and long-term support providers received advance notice, potentially allowing them to distribute fixes more quickly.

The PHP security team stressed that updating is the only complete remedy currently available for the vulnerabilities.