Two vulnerabilities are due to be released by developers of the server scripting language PHP, which is foundational to a large portion of web technology on the internet. The following CVE tracking numbers were provided, although with limited technical information or confirmation of affected versions from the core developers.

• CVE-2026-109618
• CVE-2026-109619

Following the announcement and disclosure of the vulnerabilities’ severity, security researchers such as WatchTowr began to investigate and provide details on the upcoming patch.

This included that the vulnerabilities are remote code execution vulnerabilities with severe implications – remote code execution across a broad range of versions from PHP5 onwards. Given the technologies’ deployment in internet-facing applications, this presents high risk of remote exploitation. Notably, WatchTowr does not believe that the vulnerability is being exploited at the time of writing

The systems most at risk are all systems which make use of PHP. This is a diverse range of technologies including Wordpress, Joomla and Magento which are already known for being widely exploited.

At the time of writing, the upcoming release of the patch will create a race between threat actors and system administrators to apply the patch before exploits can be developed and deployed. Working proof-of-concept exploits are already reportedly available, and therefore some system administrators are reportedly taking websites down temporarily until the patch is released.

Integrity360 will be monitoring the release of the patch and provide further insights as the release of this critical vulnerability unfolds.

If you manage any system which uses PHP in your organisation’s environment, we recommend contacting Integrity360 for advice and support.