Palo Alto Networks urges patching of two critical PHP flaws
PHP released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 after the two 9.2-rated vulnerabilities were disclosed on 22 October.
Palo Alto Networks has urged companies worldwide to check for and respond to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on 22 October. Both flaws were rated 9.2 on the CVSS 4.0 severity scale and could allow remote code execution, according to dailysecu.com.
CVE-2026-109618 involves request-handling state left abnormal in low-memory conditions, while CVE-2026-109619 is a use-after-free flaw.
Palo Alto Networks' threat research group Unit 42 estimated that more than 22.6 million internet-exposed PHP instances fall within the potential impact scope. The company did not indicate that all of those instances are exploitable or compromised.
PHP has released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Companies still running unsupported PHP 8.1 or earlier are advised to migrate.
Protections and recommendations
Palo Alto Networks said its Frontier Virtual Patching feature provided protection before the official disclosure, and that its next-generation firewalls and Prisma Access can block related attacks. The company recommended five measures, including mapping open-source exposure, prioritizing risks, securing AI adoption, virtual patching and AI-driven real-time security operations.
Quick answers
Which PHP versions fix the two critical vulnerabilities?
PHP released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Companies on unsupported PHP 8.1 or earlier are advised to migrate.
How severe are CVE-2026-109618 and CVE-2026-109619?
Both were rated 9.2 on the CVSS 4.0 severity scale and could allow remote code execution.
How many PHP instances are in scope?
Unit 42 estimated more than 22.6 million internet-exposed PHP instances fall within the potential impact scope, without indicating that all are exploitable or compromised.