The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has issued an alert after the PHP Foundation provided advanced notice of two critical vulnerabilities in PHP.
The ACSC said PHP is widely used in web applications and that the alert is aimed at technical teams responsible for network security, asset management and system administration across sectors, as well as people operating PHP workloads, websites and applications.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carry a critical CVSS score of 9.2 and could allow unauthenticated attackers to remotely execute malicious code on vulnerable web servers without requiring login credentials.
The vulnerabilities affect multiple PHP deployment environments, including Apache mod_php and PHP-FPM. Researchers have already demonstrated successful exploitation,
The ACSC advised organisations and individuals to identify where PHP is used in their environments, monitor official PHP guidance, prepare to apply security patches when they become available, and monitor PHP applications and associated environments for potentially malicious activity.
PHP Security Release page at https://www.php.net/index.php#2026-10-20-1 and further information is available on its website at https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php.
