NCC-MT is sharing the following public cyber-security advisory from MT-CSIRT concerning critical vulnerabilities affecting PHP.
Critical PHP vulnerabilities: organisations urged to take action.
Two critical vulnerabilities affecting PHP, CVE-2026-109618 and CVE-2026-109619, have been disclosed and security updates are now available.
The vulnerabilities may allow an unauthenticated attacker to remotely execute code on vulnerable systems.
Organisations are strongly encouraged to:
- Identify systems and applications using PHP, prioritising internet-facing services;
- Apply the latest security updates without delay;
- Check whether third-party products and services may include affected PHP components;
- Where immediate patching is not possible, assess measures to reduce or isolate exposure until remediation is completed; and
- Continue monitoring systems and relevant vendor security advisories.
Organisations should consult the official PHP security guidance and other trusted national and European cybersecurity authorities for the latest technical information.
MT-CSIRT continues to monitor developments in coordination with its national and European partners.