Critical PHP Zero-Day Vulnerabilities: What You Need to Know

21 October 2026 | Security Advisory | Critical

Two critical vulnerabilities have been disclosed in PHP, identified as CVE-2026-109618 and CVE-2026-109619. Both have received a CVSS v4.0 score of 9.2 and could potentially allow unauthenticated remote code execution (RCE).

PHP powers millions of websites and business applications worldwide. Successful exploitation could allow attackers to execute malicious code, access sensitive information, or compromise underlying servers.

The PHP security team has scheduled emergency security updates for 21 October 2026 at 16:00 CEST.

What happened?

On 20 October 2026, information about two previously undisclosed PHP vulnerabilities became public ahead of their planned disclosure. The PHP security team subsequently announced an emergency security release.

According to CERT-EU, both vulnerabilities could potentially allow attackers to execute arbitrary code remotely without authentication.

Preliminary information suggests that PHP versions dating back to PHP 5 may be affected. However, the exact affected versions and exploitation prerequisites have not yet been officially confirmed.

These vulnerabilities affect the PHP runtime itself, meaning applications built using WordPress, Drupal, Magento, Laravel, and other PHP frameworks may also be exposed.

What should organisations do?

Organisations running PHP should prioritise identifying vulnerable installations and deploying the security updates as soon as they become available.

We recommend the following actions:

1. Identify affected systems: Inventory PHP installations across web servers, containers, and applications. Prioritise internet-facing systems.
2. Install security updates: Deploy the patched PHP versions immediately after their release. Ensure PHP-FPM services are restarted and container images are rebuilt where applicable.
3. Apply temporary mitigations: Disable PHP session upload progress by setting session.upload_progress.enabled = Off in the PHP configuration. This reduces the attack surface associated with one of the vulnerabilities but does not address both issues.
4. Restrict unnecessary exposure: Limit access to administrative interfaces and applications that do not require public accessibility.
5. Monitor for compromise: Investigate suspicious HTTP requests, unexpected process execution, unusual outbound connections, and unauthorised modifications to application files.

Temporary mitigation: Disable session upload progress

One recommended mitigation is disabling PHP’s session upload progress functionality. This can be configured in php.ini:

session.upload_progress.enabled = Off

Restart the relevant PHP service to ensure the configuration change takes effect.

Important: This mitigation only addresses part of the potential attack surface. It does not eliminate both vulnerabilities and should not replace installing the official security updates.

How DeepBlue can help

At DeepBlue Security & Intelligence, we help organisations identify vulnerable systems, assess their exposure, and investigate potential compromises.

Our penetration testing and incident response specialists can assist with identifying affected PHP installations, validating security measures, and investigating indicators of compromise.

Unsure whether your infrastructure is affected? Contact DeepBlue Security & Intelligence for assistance.

References

• PHP Security Team: Upcoming Critical PHP Security Release
• CERT-EU: Security Advisory 2026-018

This article reflects information available on 21 October 2026. Technical details and remediation guidance may change as additional information becomes available.