Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Threat Research advisory vulnerability php

[We have updated the original advisory following PHP’s release of updates and additional details.]

On October 20, 2026, PHP announced an upcoming security release to address two critical (CVSS score of 9.2) vulnerabilities. Third-party sources identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. According to reports, the issues impact multiple PHP versions and allow for remote code execution.

On October 21, PHP released updated versions to address these issues and stated that “all PHP installations serving web requests” are at risk. A user on the X platform claims to have created a working proof-of-concept exploit. As of this publication, active exploitation has not been reported in the wild.

Recommended actions

Counter Threat Unit™ researchers recommend that customers identify potentially vulnerable systems and upgrade as appropriate. In the interim, organizations should consider taking internet-facing PHP-powered systems offline if feasible or putting them behind network-layer authentication (e.g., ZTNA). Additionally, network defenders should evaluate the potential for exploitation in their environment and monitor for suspicious activity. The PHP advisory lists mitigations for organizations who cannot immediately upgrade but notes that updating is the only complete solution.

Sophos countermeasures

SophosLabs continues to monitor the threat landscape for activity related to these vulnerabilities and will deliver detections and protections as available. An internal investigation is also underway to determine if Sophos products or services are affected.

About the Author(s)

Sophos Counter Threat Unit Research Team

Sophos Counter Threat Unit™ (CTU) researchers are recognized authorities in the cybersecurity field, regularly contributing expert analysis to global media, publishing technical analyses for the security community, and presenting about emerging threats at leading security conferences. Backed by Sophos’ advanced security technologies and a broad network of intelligence contacts and partners, the CTU™ plays a critical role in identifying and tracking threat actors and analyzing anomalous activity, uncovering new attack techniques, threats, and major shifts in the threat landscape.