Many of you may have already been alerted but we wanted to be certain you have seen the alert related to two critical vulnerabilities that were recently disclosed in PHP, a widely used web technology. PHP powers a large share of websites and web applications, including WordPress and hundreds of other widely used tools. The PHP project released patches on October 21.
Overview:
On October 21, 2026, CVE-2026-109618 (https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and CVE-2026-109619 (https://nvd.nist.gov/vuln/detail/CVE-2026-109619) were published related to critical vulnerabilities in PHP that allow for remote code execution. These vulnerabilities impact every PHP version released in the past decade, from version 5.4. Immediate attention to these vulnerabilities is advised for all internet accessible systems.
Mitigation:
CISA has released information regarding this vulnerability at https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching, and are encouraging everyone running PHP to upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. Organizations which cannot update immediately to these releases of PHP should review the guidance at https://www.php.net/
or disconnect internet accessible servers until the issue can be resolved.
It is important to note that PHP 8.1 and older no longer receive updates from the PHP project.
In addition, check for signs of compromise, such as PHP processes launching shells, new or changed files in the web root, and new cron jobs or user accounts. For additional information or resources there are several articles & notifications below.
Additional Information:
"Security advisory: Critical remote code execution vulnerabilities, update now", PHP, https://www.php.net/archive/2026.php#2026-10-21-5
"PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", Wiz IO, https://www.wiz.io/blog/php2shell-php-rce
"Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]", SANS Internet Storm Center, https://isc.sans.edu/forums/diary/Critical+PHP+Vulnerability+CVE2026109618+CVE2026109619+infocon+yellow/33440/
"Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619", Unit 42 (Palo Alto Networks), https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
"Flaw in PHP computer language leads to shutdown of websites around world", The Guardian,
"Critical vulnerabilities in commonly used web code spark rush to update systems", NBC News, https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-update-systems-rcna604751
Contact BHS Insurance today to learn how we can support your business and your workforce.