UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP

CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities affecting PHP that could allow for unauthenticated remote code execution on affected servers. PHP is commonly used on websites and in web applications. PHP is used to develop dynamic websites and web applications and for APIs. The NCSC is aware of reports of active exploitation.

(Updated 10:20am, 22-10-26) Please note that certain implementations of PHP, including firewalls, edge devices, and other embedded platforms, may require independent assessment and remediation. Any necessary updates or patches must be applied separately in accordance with the vendor's guidance and the specific implementation in use.

The NCSC encourages organisations in New Zealand that use the affected products to review the advisory and apply the remediation as soon as possible. We also urge affected organisations to investigate unauthorised access or compromise of the affected products.