AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1

Number: AL26-026Date: October 21, 2026Updated: October 23, 2026 This Alert is intended for IT professionals and managers. An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting PHPFootnote 1. In response to the vendor advisory, the Cyber centre released an advisory on October 21, 2026Footnote 2. Tracked as CVE-2026-109618Footnote 3 and CVE-2026-109619Footnote 4, these vulnerabilities are Use After Free vulnerabilities (CWE-416)Footnote 5 affecting multiple versions of PHP. Known as “php2shell”Footnote 6, successful exploitation could allow an unauthenticated threat actor to execute arbitrary code on an affected system. Internet-facing PHP servers and applications are at heightened risk. The PHP Security Team has released security updates addressing these vulnerabilities....