AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting PHPFootnote 1. In response to the vendor advisory, the Cyber centre released an advisory on October 21, 2026Footnote 2.

Tracked as CVE-2026-109618Footnote 3 and CVE-2026-109619Footnote 4, these vulnerabilities are Use After Free vulnerabilities (CWE-416)Footnote 5 affecting multiple versions of PHP. Known as “php2shell”Footnote 6, successful exploitation could allow an unauthenticated threat actor to execute arbitrary code on an affected system. Internet-facing PHP servers and applications are at heightened risk.

The PHP Security Team has released security updates addressing these vulnerabilities. Organizations should identify affected systems and apply the appropriate updates immediately.

PHP remains a widely deployed technology and continues to support a substantial proportion of web applications worldwide.

All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. PHP assess the risk as greatest for mod_php, as a demonstrated exploit allows an unauthenticated request to trigger the vulnerability before application-level code is executed.

The Cyber Centre has observed open-source reporting indicating that a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.

Suggested actions

The Cyber Centre strongly recommends that organizations running affected PHP versions upgrade to the following fixed version:

affected PHP versions upgrade

Affected Product	Affected Versions	Fixed Versions
PHP	8.5.x prior to 8.5.12	8.5.12
PHP	8.4.x prior to 8.4.27	8.4.27
PHP	8.3.x prior to 8.3.36	8.3.36
PHP	8.2.x prior to 8.2.35	8.2.35

Note: versions 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.

The Cyber Centre recommends that organizations:

• Update affected PHP installations immediately to a fixed, supported release.
• Prioritize Internet-facing systems and applications that process untrusted input.
• Identify third-party products, appliances and containers that include vulnerable PHP componentsFootnote 7.
• Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.
• Monitor for potential compromise by reviewing web server, application, authentication, and endpoint logs for suspicious activity.
• Investigate unexpected processes, commands, files, accounts or outbound connections associated with PHP or web-server services.
• Continuously monitor third-party vendors for security updates, including appliances, applications and services that bundle PHP, and apply applicable patches without delay.

Organizations should also review the Cyber Centre’s Top 10 IT Security ActionsFootnote 8.

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References