Critical PHP flaws: CERT-FR urges isolating unpatched equipment until fixes are applied
Facing two remote code execution flaws, CERT-FR recommends isolating affected equipment, then migrating to a maintained, patched version of PHP.
By GennnAi··1 min read
PHP released fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, which affect PHP 8.2 to 8.5 releases earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CERT-FR observes exploitation attempts targeting specific deployments. Versions 5.x, 7.x, 8.0 and 8.1 are no longer supported. Another flaw, CVE-2026-115560, will be fixed in the next update cycle, as PHP considers exploitation conditions unlikely. Only the update fully protects; PHP also published interim mitigations.
Source: CERT-FR, published on October 21, 2026.