H-ISAC Vulnerability Bulletins TLP WHITE: Two Critical Remote Code Execution Vulnerabilities in PHP (CVE-2026-109618 & CVE-2026-109619)

UPDATE: On October 21, 2026, Health-ISAC created a dedicated channel regarding the release of patches for the two critical remote code execution vulnerabilities affecting PHP infrastructure.

On October 20, 2026, the PHP development team issued a notice advising administrators to prepare for emergency security updates.

The upcoming patches address two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that were reportedly leaked before their scheduled disclosure. Security researchers indicate these are remote code execution flaws affecting multiple PHP versions.

Although no active exploitation has been observed, administrators are urged to apply updates promptly once official patches are released.

Health-ISAC provides this information to increase situational awareness and encourage organizations to assess their risk exposure to the vulnerabilities.

View the detailed report below.