Critical PHP Vulnerabilities: Temporary Mitigation
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been reported in PHP, with potential for remote code execution. Vulnerabilities are weaknesses in software that attackers can exploit to compromise systems and execute malicious code.
As of 21 October 2026, 16:00, technical information remains limited. Possible Security provides the following interim mitigation recommendations for Apache2 with PHP running as module. They can be adapted for other web servers by readers familiar with their server's configuration. Apply official security patches as soon as they become available.