PHP flaws: the 22 October alert separates patches from intrusions
· BehindLines newsroom
New Zealand's National Cyber Security Centre updated its warning about two critical PHP vulnerabilities on 22 October. It says it is aware of reports of active exploitation. The update follows the PHP project's release of fixes on 21 October: making an update available and installing it on servers are separate steps.
PHP is used to run websites and web applications. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, can allow remote code execution without authentication on an affected server. That possibility alone does not establish that any particular website has been compromised. The New Zealand alert provides no worldwide count of victims.
The announced fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project also directs users of Linux distributions and long term support services to their suppliers for the appropriate packages. The PHP Foundation confirms that both problems affect the engine's internal workings and that fixing them involved mechanisms that are difficult to change.
The warning extends beyond websites managed directly by a web team. In an addition dated 22 October at 10:20 am, the New Zealand centre explains that some PHP implementations, including those in firewalls and other equipment, require assessment and fixes specific to the vendor. Updating the main server therefore does not establish that every affected component has been addressed.
For exposed organisations, the centre calls for both applying fixes and investigating possible unauthorised access. These tasks answer different questions: closing an available vulnerability and determining whether it has already been used. The consulted sources do not identify who is responsible for the attacks or establish their scale.
Written with AI assistance, verified.