Jump to the main content block
  1. Home
  2. Information Security
  3. Vulnerability Alert

【Vulnerability Alert】PHP Has High-Risk Security Vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Please Verify and Take Action as Soon as Possible

publish date : 2026-10-22 update date : 2026-10-22

Source: Ministry of education information & communication security contingency platform

Publication Number TACERT-ANA-2026102209102727 Publication Time 2026-10-22 09:24:28
Incident Type ANA-Vulnerability Alert Discovery Time 2026-10-22 09:24:28
Impact Level High  
[Subject]
【Vulnerability Alert】PHP Has High-Risk Security Vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Please Verify and Take Action as Soon as Possible
[Content]
Forwarded from the National Institute of Cyber Security Cybersecurity Alert NICS-ANA-2026-0000952

Researchers have discovered Use After Free vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP. Attackers can send specially crafted multipart/form-data HTTP requests to execute arbitrary code at the underlying level of the server without authentication. Proof-of-concept (PoC) exploit code for these vulnerabilities has already appeared online. Please verify and take action as soon as possible.

Information Sharing Level: WHITE (Information content can be publicly disclosed)
[Affected Platform]
End-of-Life (EOL) Versions:
All versions of PHP 5.4.x through 5.6.x
All versions of PHP 7.0.x through 7.4.x
All versions of PHP 8.0.x through 8.1.x

Versions Still Officially Supported:
PHP 8.5.11 and earlier versions (inclusive)
PHP 8.4.26 and earlier versions (inclusive)
PHP 8.3.35 and earlier versions (inclusive)
PHP 8.2.34 and earlier versions (inclusive)

Note: Content Management Systems (CMS) such as WordPress, Drupal, Joomla, and Magento mostly use PHP as their underlying framework. It is recommended to conduct an inventory and take action as soon as possible.
[Recommended Actions]
Official patches or updates will be released to address these vulnerabilities. System administrators are advised to upgrade PHP to the following latest supported security versions as soon as possible:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

Official Update Announcement and Download URL: https://www.php.net/downloads.php

Note: PHP 8.1 and earlier versions (inclusive) have reached End-of-Life (EOL) and will no longer receive official patches or updates. It is recommended to upgrade to the above versions that are still officially supported as soon as possible.
[Reference]
1. https://nvd.nist.gov/vuln/detail/CVE-2026-109618
2. https://nvd.nist.gov/vuln/detail/CVE-2026-109619
3. https://www.php.net/archive/2026.php#2026-10-20-1
4. https://www.php.net/downloads.php
(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
Organizer: Computer Center
Click Num:
Print