Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): what to do now

What happened and what to do

The SANS ISC advisory covers two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP.net announced that it would release a critical update on 21 October 2026, and the SANS ISC changed the infoCon to yellow because of the widespread use of the language, the expected severity of the flaw (CVSS 9.4), and the existence of preliminary proof-of-concept exploits before the patch is available.

For a company, the first step is to establish where PHP runs, in which versions, and which instances are exposed to the internet, including legacy applications and third-party services. Next, applying the patch should be prioritized as soon as it is available, with a defined maintenance window and a tested rollback. While the fix is pending, the attack surface can be reduced with temporary WAF rules, restricted access to sensitive endpoints, and log monitoring for exploitation attempts. A dashboard showing the status of each application and PHP version helps track the remediation through to completion.

How the consultancy can help

Wendelmaques can diagnose the exposure of your PHP estate, mapping versions, exposed services and dependencies, and propose a prioritized remediation plan. In implementation, we set up automated inventory, temporary mitigation rules and monitoring for exploitation attempts, with ongoing operation on your own infrastructure.

Next step

If your company runs PHP in internal systems or in customer-facing products, send a short description of your situation and receive a scoped proposal.