Public Proof-of-Concept Claimed for Critical PHP Flaws: Patch Web Servers Now

PHP announced on October 20, 2026 that it would release a security update for two critical vulnerabilities, tracked by third parties as CVE-2026-109618 and CVE-2026-109619. Both carry a severity score of 9.2 out of 10. According to reports, they affect multiple PHP versions and could allow an attacker to run their own code on a vulnerable system from a remote location.

PHP released fixed versions on October 21 and said that "all PHP installations serving web requests" are at risk. A user on the X platform has claimed to have built a working proof-of-concept exploit. Sophos notes that, as of publication, active exploitation has not been reported in the wild. Sophos is monitoring for related activity and investigating whether its own products or services are affected.

Sophos Counter Threat Unit researchers advise organisations to find potentially vulnerable systems and upgrade as appropriate. Where that is not possible straight away, internet-facing PHP-powered systems could be taken offline, or placed behind network-layer authentication such as ZTNA. Defenders should also assess their exposure and watch for suspicious activity. PHP's advisory lists temporary mitigations, but stresses that updating is the only complete solution.

This summary is based on the opening of the Sophos advisory and does not cover the full article.