1-minute read
What a defender needs to know
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked on October 20 ahead of a PHP security release scheduled for October 21 at 14:00 UTC. The PHP security team rated both 9.2 under CVSS v4.0 and said affected and fixed versions would come with the release. Huntress describes the issues as remote code execution, but the affected builds and specific entry path await PHP’s release details. Huntress had seen no exploitation of these two flaws in its partner environments when it published its analysis.
List PHP interpreters on exposed web servers, in control panels and in software that bundles php.exe or php-cgi.exe. Record running build and package source. PHP currently supports branches 8.2 through 8.5; migrate older end-of-life deployments or restrict their public access while preparing an upgrade. Once the PHP release lands, compare each installation with its affected-version list and check distributor backports. Verify the running version or installed package after patching.
Watch php-fpm, php-cgi, httpd and apache2 for children such as sh, bash, curl or wget; investigate parent process, command line, request and file writes together. That is a general PHP-compromise clue rather than a signature for these CVEs. Linux web servers without process telemetry have a blind spot here. Preserve web and PHP logs if a suspicious child appears.