The PHP Foundation has released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which when combined allow unauthenticated remote code execution on affected systems. The flaws were identified by researchers at Calif during an AI-assisted source code audit of PHP, and independently confirmed by Google’s Wiz team.
Organisations running PHP should review the official advisory and apply the recommended updates as a priority.
Guidance may change as the situation develops, checking the official PHP channels and the NCSC website regularly for updates and guidance.
PHP Updates: https://www.php.net/index.php#2026-10-20-1
NCSC Guidance: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
Stay Ahead of Exploitation
Multiple exploitation attempts have been reported since disclosure, and working exploit code is now public. Organisations should treat this as an active threat and use available intelligence to guide precautionary action.
Daniel Stewart, Head of Threat Intelligence at LRQA Cyber said:
“Our team regard this as a significant concern. There are over 2.1 million internet-facing PHP hosts globally, and while not all will be running vulnerable configurations, the attack surface is substantial.
With the increasing speed at which proof of concept code is being weaponised, in part through AI enablement, the window between disclosure and widespread exploitation continues to shrink.”
It is important to consider systems that can be easily overlooked during incidents like this. PHP is not limited to websites and web applications, it often runs behind the scenes as part of management interfaces part of network applications, load balancers and embedded devices.
The role of AI
The underlying weakness is not new. An out-of-memory flaw in PHP’s shutdown handling had been identified in previous research, but turning it into a working remote code execution exploit required a complex chain of steps. That complexity had historically kept it impractical to exploit. AI models reduced the effort involved by identifying the known weakness as a path to a critical outcome and assisting in the development of a working exploit chain.
As AI lowers the cost of discovering and weaponising complex vulnerabilities, organisations should expect critical disclosures to become more frequent and the window between disclosure and exploitation to narrow.
Strong asset visibility, mature patching processes, and the ability to respond quickly are increasingly important.
If you are unsure of your exposure and require support, contact the LRQA Cyber team to arrange a Digital Attack Surface Assessment (DASA) and identify systems that may be at risk.
Because guidance may change as the situation develops, we advise checking the official PHP channels regularly for updates.