AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2

Number: AL26-026
Date: October 21, 2026
Updated: October 27, 2026

This Alert is intended for IT professionals and managers.

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting PHPFootnote 1. In response to the vendor advisory, the Cyber centre released an advisory on October 21, 2026Footnote 2.

Tracked as CVE-2026-109618Footnote 3 and CVE-2026-109619Footnote 4, these vulnerabilities are Use After Free vulnerabilities (CWE-416)Footnote 5 affecting multiple versions of PHP. Known as “php2shell”Footnote 6, successful exploitation could allow an unauthenticated threat actor to execute arbitrary code on an affected system. Internet-facing PHP servers and applications are at heightened risk.

The PHP Security Team has released security updates addressing these vulnerabilities. Organizations should identify affected systems and apply the appropriate updates immediately.

PHP remains a widely deployed technology and continues to support a substantial proportion of web applications worldwide.

All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. PHP assess the risk as greatest for mod_php, as a demonstrated exploit allows an unauthenticated request to trigger the vulnerability before application-level code is executed.

The Cyber Centre has observed open-source reporting indicating that a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.