Exploitation reportedWed, 28 Oct 2026
Two PHP vulnerabilities exploited: patch the running services and investigate compromise
Check public sites, APIs, internal back offices and products with embedded PHP. Update the runtime and review systems that were reachable before the patch.
Article
The Canadian Centre for Cyber Security reported that CISA added CVE-2026-109618 and CVE-2026-109619 to KEV on October 26, 2026. The PHP project published advisories October 21 and rates both flaws 9.2 under CVSS v4.0.
For CVE-2026-109618, out-of-memory error handling can leave invalid memory state. PHP demonstrated unauthenticated RCE under mod_php. CVE-2026-109619 requires consecutive requests to reach the same worker and application operations that create and reuse stale state. PHP demonstrated RCE on particular mod_php and FPM paths.
Update the relevant PHP branch to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a later security release. Restart workers and verify the running version. For embedded PHP, follow the product vendor’s update instructions and plan migration off unsupported branches.
- 01
Reach a PHP service
A public or internal endpoint processes input using an affected runtime.
- 02
Trigger a vulnerable path
Exploitation depends on the error handling or same-worker behavior in the relevant CVE.
- 03
Run code in the service context
Impact depends on the PHP worker’s access to files, accounts, networks and data.
What to do: from the perimeter to internal systems
- 01
Restrict exposure and retain logs
Limit unnecessary entry points, preserve WAF, application, host and database logs, and isolate systems when investigation warrants.
See what to doResources: 1
TWISA member solutions
Restrict exposure and retain logs
Limit unnecessary entry points, preserve WAF, application, host and database logs, and isolate systems when investigation warrants.
- 02
Update the actual runtime
Include outsourced applications, containers and embedded runtimes. Restart workers and verify versions.
- 03
Look for continued access
Check unexpected PHP files, scheduled jobs, outbound connections, account activity and data access.
See what to doResources: 1
TWISA member solutions
Look for continued access
Check unexpected PHP files, scheduled jobs, outbound connections, account activity and data access.
- 04
Rebuild and verify
If compromise is confirmed, rebuild from trusted images and validate access controls and business functions before reconnecting.
See what to doResources: 1
TWISA member solutions
Rebuild and verify
If compromise is confirmed, rebuild from trusted images and validate access controls and business functions before reconnecting.
Public and internal services, PHP workers, identities and data
Allow authorized traffic and apply controls at each layer.
- 01
Restrict exposure and retain logs
Public and internal services, PHP workers, identities and data
Validate the controlLimit unnecessary entry points, preserve WAF, application, host and database logs, and isolate systems when investigation warrants.
- 02
Update the actual runtime
Public and internal services, PHP workers, identities and data
Validate the controlInclude outsourced applications, containers and embedded runtimes. Restart workers and verify versions.
- 03
Look for continued access
Public and internal services, PHP workers, identities and data
Validate the controlCheck unexpected PHP files, scheduled jobs, outbound connections, account activity and data access.
Feed logs and traffic data from each layer into monitoring and response.
- Rebuild and verifyIf compromise is confirmed, rebuild from trusted images and validate access controls and business functions before reconnecting.
Test and verify
Use authorized asset discovery, vulnerability scanning, penetration and API testing, and attack simulation. Retest after changes and verify monitoring against actual system behavior. Verify request, alert, block and backend result separately wherever a WAF is used.
TWISA member solutions
Restrict exposure and retain logs
Limit unnecessary entry points, preserve WAF, application, host and database logs, and isolate systems when investigation warrants.
Look for continued access
Check unexpected PHP files, scheduled jobs, outbound connections, account activity and data access.
Rebuild and verify
If compromise is confirmed, rebuild from trusted images and validate access controls and business functions before reconnecting.
Sources and further reading
- Canadian Centre for Cyber Security exploitation update
- PHP advisory for CVE-2026-109618
- PHP advisory for CVE-2026-109619
- Read the full article in Traditional Chinese
Alert updated: 2026/10/28. Check the vendor’s latest guidance for product support and patch status.