Critical advisory, 20 October 2026
PHP Cybersecurity
Issue 2026.
PHP has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run their own code on a PHP server with no login, and both can expose the passwords, tokens and API keys held in its memory. Attacks are already being seen in the wild.
Our global teams patch, harden and recover PHP estates, and we reply to every request immediately.
Talk to an expert nowWhat we can do
Patch it, harden it, respond, or take it over.
Five ways we engage, starting today. Every engagement begins with an immediate answer from a human expert.
Go to the request formPHP maintenance and emergency patching
DevOps and deployment hardening
Security emergency response
Project rescue
Product rescue
Request support
Get support now.
Tell us what is exposed and we will reply immediately. Book a call below if you would rather speak to someone right away.