CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available
PHP Core RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 are critical, with NodeZero offering a rapid response
Run NodeZero?
Get an email when a reviewed story names NodeZero, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution and have been patched by PHP on October 21, 2026. NodeZero has released a rapid response check to help identify affected systems, urging immediate patching, especially for internet-facing infrastructure. Exploitation attempts are ongoing, with varying success depending on system configurations.
The lesson from this incident
Full lessonTwo critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution, meaning attackers can compromise systems without any credentials whatsoever. The patch was made available on October 21, 2026, yet exploitation attempts are already ongoing, highlighting the dangerous window between patch release and deployment. Internet-facing infrastructure running unpatched PHP is at immediate risk of full system compromise. This incident underscores that delays in applying security patches — even by days — can have catastrophic consequences when vulnerabilities are actively being weaponized.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-109618
- cve — CVE-2026-109619
- cve — CVE-2026-115560