The UK’s National Cyber Security Centre (NCSC) has warned organisations about two critical PHP security vulnerabilities: CVE-2026-109618 and CVE-2026-109619.
Hackers could exploit these flaws to execute malicious code on vulnerable web servers without authentication. The NCSC urges businesses to update their PHP systems immediately to prevent cyberattacks and protect sensitive data.
What Happened?
PHP released security updates to fix two critical vulnerabilities that could allow hackers to gain unauthorised access to web servers.
Both vulnerabilities involve memory management issues that attackers could exploit to execute harmful commands.
- CVE-2026-109618: Memory exhaustion can interrupt PHP processes and cause errors in internal request data.
- CVE-2026-109619: PHP may access previously freed memory, which creates opportunities for cyberattacks.
These security flaws increase the risk of remote code execution (RCE). Therefore, organisations must take immediate action to secure their PHP applications.
Who Is Affected?
These vulnerabilities may affect organisations that use PHP-powered websites, applications, and web servers.
Businesses that operate WordPress websites, e-commerce stores, and custom PHP applications should review their systems.
Hackers may target vulnerable internet-facing servers without login credentials. As a result, organisations should check their PHP versions and prioritise security updates.
What Should We Do?
The NCSC recommends several important steps to reduce security risks:
- Check PHP Versions: Identify all PHP installations across your websites, servers, and applications.
- Update PHP Immediately: Install the latest security patches and upgrade outdated PHP versions.
- Apply Temporary Fixes: Follow official PHP security guidance if you cannot update immediately.
- Monitor Server Activity: Review security logs and investigate suspicious activity or potential backdoors.
- Secure Vulnerable Systems: Temporarily disable services if you cannot apply the necessary security fixes.
- Stay Updated: Follow NCSC and PHP security advisories for new threats and updates.
Regular PHP updates help businesses prevent cyberattacks, protect sensitive information, and maintain website security.
Organisations should act quickly to address these vulnerabilities and strengthen their cybersecurity defenses.
