ASD warns of critical PHP flaws ahead of patches
PHP maintainers rate two vulnerabilities at 9.2 out of 10, as alleged technical details appear online before a disclosure embargo ends.
By Quang Dinh
The Australian Signals Directorate has urged organisations to prepare to patch PHP applications after two critical security vulnerabilities emerged before their scheduled disclosure. PHP maintainers are preparing fixes and have asked users to be ready to update.
PHP rates the flaws, identified as CVE-2026-109618 and CVE-2026-109619, at 9.2 out of 10 for severity. In an alert dated 21 October 2026, ASD said they may affect versions from PHP 5 onwards and advised users to monitor their applications.
A Hacker News post citing unnamed sources claimed the vulnerabilities could allow remote code execution. A researcher subsequently published alleged technical details and two purported proofs of concept. Their publication preceded the end of the disclosure embargo.
CERT-EU, which provides cyber security services to European Union institutions, also advised organisations to prepare to install patches immediately. Where that is not feasible, it said organisations should consider temporarily separating publicly accessible applications from public networks until a fix becomes available.
PHP is used by server-side applications including WordPress, Drupal and Magento, which run on millions of websites worldwide.
