Critical Remote Code Execution Vulnerabilities (CVE‑2026‑109618, CVE‑2026‑109619) Discovered in PHP 8.2–8.5
What Happened – The PHP development team issued emergency patches for two critical remote‑code‑execution flaws (CVE‑2026‑109618 and CVE‑2026‑109619). Both receive a CVSS v4.0 score of 9.2 and could let an unauthenticated attacker execute arbitrary commands on any web server running the affected PHP versions.
Why It Matters for Trust & Control Assurance
- Continuous vulnerability‑management is a core control‑objective; missing a critical RCE flaw erodes the evidentiary trail auditors expect.
- Timely patch deployment provides defensible proof of due‑diligence and reduces the likelihood of a data‑exposure incident.
- Mapping patch‑process metrics to the Verisq Common Framework (VCF) enables a single control to satisfy multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Organizations that host web applications or SaaS platforms using PHP 8.2, 8.3, 8.4 or 8.5, including managed‑hosting providers, cloud‑infra services, and internal development teams.
Recommended Actions
- Inventory every PHP runtime in your environment and record the exact version.
- Deploy the emergency patches (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) immediately.
- Capture patch‑installation logs as control‑assurance evidence and map them to the “Vulnerability Management” objective in your audit framework.
- Enable automated version‑checking tools to alert on future critical releases.
Source: Help Net Security article
Technical Notes
- CVE‑2026‑109618: Remote code execution via crafted PHP code that bypasses authentication (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35).
- CVE‑2026‑109619: Similar RCE path leveraging PHP’s handling of certain input streams.
- Both vulnerabilities are rated Critical (CVSS 9.2). No public exploit code has been released, but the risk of weaponization is high.
Source: PHP security advisory (linked in the article)