Cydea’s risk advisories are intended for senior management to aid their understanding of current events and the cyber risk posed to their organisations.
Immediate action: Identify all internet-facing servers running PHP and upgrade to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately to mitigate unauthenticated remote code execution risks.
What has happened?
PHP, a technology used to run websites and online services, has published security updates addressing critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting memory handling and global state management.
These vulnerabilities are caused by flaws in how PHP manages information behind the scenes. Attackers could exploit these weaknesses remotely to run malicious commands on affected web servers without needing a username, password or any interaction from users, exposing websites and applications even if their own code is secure.
The National Cyber Security Centre (NCSC) is encouraging UK organisations using any version of PHP to take immediate action to mitigate this issue, as successful exploitation provides unauthorized control over key infrastructure and potentially disrupt business operations.
What is the risk?
Vulnerable unpatched PHP installations could allow remote threat actors to execute malicious commands on web servers, potentially gaining control over server infrastructure, compromising sensitive data, or accessing connected internal networks.
Source:
- Cyber criminals / Opportunistic attackers
Risk events:
- System Intrusion (Remote code execution / Software exploit)
- Information Breach (Unauthorised server access and data extraction)
Consequences:
- Operations (System downtime) / Financial (Response and recovery costs)
What factors drive the consequences?
Criticality of web application functionality, sensitivity of data hosted on target web servers, and network segregation depth.
What factors drive the frequency?
Public exposure of web servers running vulnerable PHP versions and availability of public exploit proof-of-concepts.
How may it evolve?
As automated exploitation scripts circulate, attacks targeting exposed PHP services are expected to rise significantly, leading to ransomware deployment or wider network compromise.
Source:
Risk events:
- System Intrusion (Software exploit)
- Malware (Ransomware)
- Information Breach (Unauthorised access to information)
Consequences:
- Operations (Business disruption)
- Compliance (Regulatory fines)
- Financial (Unplanned response costs)
- Strategic (Reputational damage / Adverse reporting)
What action is required?
Executive actions and questions for IT and security leadership:
- Inventory & Prioritise: Direct technical teams to identify all internet-facing systems running PHP and ensure emergency patching is scheduled.
- Patch & Mitigate: Confirm PHP is updated to version 8.5.12, 8.4.27, 8.3.36, or 8.2.35 across all environments (focusing on mod_php and PHP-FPM deployments). If updating is temporarily blocked, coordinate temporary mitigations while scheduling urgent patching.
- Monitor & Verify: Ensure continuous monitoring for vendor security patches and request compromise assessments for critical unpatched systems.
For further information or assistance in understanding or measuring this risk to your organisation please contact us for a session with one of our cyber risk consultants.
Cydea uses the Open Information Security Risk Universe (OISRU) as a framework and taxonomy for describing information security risks independently of models or methods of analysing risks. Find out more about our contribution to the project on our cydea.tools site.
Sources:
https://www.php.net/archive/2026.php#2026-10-21-5
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
Ray Morrison
Lucia Turner
Niall McElroy
Priya Deuchande