Actively exploited

Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 Require Immediate Patching

Why it matters: Two critical PHP flaws allow unauthenticated remote code execution; authorities report active exploitation, while BBC live coverage says 32 UK government services were unavailable during security work.

Covered by 4 outlets

  • ENISA - Joint statement on critical PHP vulnerabilities ()
  • The PHP Foundation - Today's PHP Security Release, and How We're Strengthening PHP Security ()
  • New Zealand NCSC - UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP ()
  • BBC News - PHP: Minister says 32 UK government services unavailable due to global cyber-security issue - follow live ()

Published

Start with real signal

See your security surface before you subscribe.

Run the complete AYAsec workflow on Free, then move to the cadence your team needs.

Start scanning free