Critical security issue affecting PHP

The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.

PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser. PHP is also used in a range of other products.

The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.

The full PHP security advisory provides more details regarding the fixed security issue.

The NCSC will continue to monitor for any impact on UK organisations.

Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version. Organisations using older versions of PHP are highly encouraged to update to a fully supported version.

The NCSC recommends following vendor best practice advice in the mitigation of vulnerabilities. The NCSC highly encourages organisations to follow these priority actions: