Security News

ACSC Warns of Two Critical PHP Flaws That Could Let Attackers Take Over Web Servers

Australian Cyber Security Magazine · 22 Oct 2026

Key Takeaway List every website and application your business runs on PHP now, so you can apply the official patches quickly once they are released and watch those systems for suspicious activity in the meantime.

The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) has issued an alert after the PHP Foundation gave advance notice of two critical vulnerabilities in PHP. The ACSC noted that PHP is widely used in web applications. The alert is aimed at technical teams responsible for network security, asset management and system administration, as well as anyone operating PHP workloads, websites and applications.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a critical severity score of 9.2 on the CVSS scale. They could allow attackers to run malicious code remotely on vulnerable web servers without needing login credentials. The vulnerabilities affect multiple PHP deployment environments, including Apache mod_php and PHP-FPM. The source article also states that researchers have already demonstrated successful exploitation.

The ACSC advised organisations and individuals to identify where PHP is used in their environments, monitor official PHP guidance, and prepare to apply security patches when they become available. It also recommended monitoring PHP applications and their surrounding environments for potentially malicious activity. The PHP Security Release page and the ACSC alert on the cyber.gov.au website carry further information.

Summarised by CISO AI from Australian Cyber Security Magazine, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.