The Australian Signals Directorate’s Australian Cyber Security Centre has issued a Critical Alert: Act Now directive after the PHP Foundation said it was on the verge of patching a pair of critical vulnerabilities.
“PHP Foundation have released advanced notice of two critical vulnerabilities in PHP, with full details currently scheduled for public announcement on Thursday 22 October 2026 at 0100 AEDT,” the ACSC said on Wednesday afternoon.
“PHP is a widely used general-purpose scripting language, often utilised in Web Applications.”
The ACSC said that despite “related media reporting which identifies these vulnerabilities as CVE-2026-109618 and CVE-2026-109619,” the agency knows of no publicly released details as of the time of writing.
Cyber security firm WatchTowr said the CVE numbers had leaked prior to the official patch promised by PHP.
“Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2026-109618/619,” the company said in an overnight post to X, as reported on the morning of October 21 by this publication.
“We cannot share further information right now. Take this seriously and apply patches when available.”
The ACSC added that it was not aware of any exploitation, and that PHP versions 5 and older were impacted.
The agency has the following advice for Australian organisations:
- Identify PHP within their environments.
- Monitor and review PHP official guidance at PHP Security Release.
- Prepare to update and apply security patches as they become available.
- Monitor PHP applications and associated environments for potentially malicious activity.
Organisations that have been impacted, suspect impact or require advice and assistance can contact the ACSC via 1300 CYBER1 (1300 292 371).
UPDATED 21/10/26 to update accurate CVE numbering.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
