On Wednesday afternoon, the PHP project shipped an out-of-cycle security release fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on CVSS v4.0, and both can allow an unauthenticated attacker to run code on a web server. The UK National Cyber Security Centre and CERT-EU issued advisories within hours, and the NCSC is urging UK organisations to act immediately.
Most security teams will spend this week doing exactly what they should: finding their own PHP servers and patching them. That work matters. My concern, after 27 years in this industry, is the PHP nobody is looking for. It sits inside the products and services your suppliers run on your behalf, and in many cases neither you nor they have written it down anywhere.
What has actually been fixed
The first flaw, CVE-2026-109618, sits in the way PHP handles running out of memory. If an attacker can force an out-of-memory condition at the wrong moment, PHP can be interrupted while its internal request data is only half built. The clean-up routine then treats that broken data as valid. The second, CVE-2026-109619, concerns internal state that outlives the memory behind it, so a later request handled by the same worker can pick up stale data before it is reset.
In plain terms, both give an attacker a route from a crafted web request to code execution. The PHP security team considers the risk highest on Apache with mod_php, where a demonstrated exploit fires before any application code runs at all. Your secure coding standards do not get a vote. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed deployments are also in scope.
The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older no longer receive updates, although the severity has prompted the PHP team to publish minimal source backports for 7.4, 8.0 and 8.1. The project is clear that its configuration workarounds reduce exposure without making a system safe. Updating is the only complete fix.
At the time of release there were no confirmed public reports of exploitation, although at least one major infrastructure provider had spoken publicly about emerging attack activity. History tells us the gap between a critical PHP advisory and mass scanning is measured in days, not months.
Why your suppliers are the bigger problem
PHP is not just the language behind WordPress sites and marketing pages. It is quietly bundled into appliance admin consoles, helpdesk platforms, HR and payroll portals, e-commerce engines, hosting control panels and a great many SaaS back ends. Vendors rarely advertise it. It does not appear on the sales sheet, and it almost never appears in a security questionnaire response.
The scale is already showing. The Dutch NCSC has begun publishing an inventory of software products with a PHP dependency that may be affected, and the NCSC's own guidance specifically tells organisations to watch for updates from vendors whose appliances and services bundle PHP.
Now think about what that means for a typical third-party risk programme. Your supplier completed its annual questionnaire last spring. It confirmed it has a patch management policy. It may even hold a certification. None of that tells you whether the customer portal your staff log into every day, through single sign-on, is running mod_php on an unsupported branch on a server nobody has touched in two years.
That is the gap. Questionnaires tell you what a supplier intends to do. They do not tell you what is running on its estate today.
Three ways this lands on you
Your data. Suppliers process, store and host data on your behalf. A compromised PHP application at a supplier is your incident, your regulator conversation and potentially your breach notification.
Your network. Suppliers connect to you through VPNs, API keys, SSO integrations and shared service accounts. An attacker who owns a supplier's web tier can ride those trusted connections straight past your perimeter.
Your operations. The NCSC advises taking systems offline if they cannot be updated or mitigated quickly. That is the right call, and if the system belongs to a critical supplier, your service goes offline with it.
What to do this week
Patch your own estate first. Find every PHP installation, not only the old ones, and start with anything internet facing. The NCSC is explicit that all versions may be affected.
Work out which suppliers are likely to run PHP. Focus on hosted web applications, customer and employee portals, managed hosting and network appliances. Prioritise critical suppliers and those with access to your data or your network.
Ask specific questions, not generic ones. "Are you secure?" gets you a reassuring paragraph. Instead ask: Do you run PHP anywhere in the services you provide to us? Which versions? Have you moved to a fixed release? If not, which mitigations are in place and by when? Have you checked for signs of compromise?
Watch for bundled PHP in what you host yourself. On-premises software and appliances from third-party vendors will need vendor-issued updates. Track those advisories and apply them as they land.
Treat silence as a finding. Record every answer and chase every gap. A supplier that cannot tell you whether it runs PHP has told you something important about its asset management.
Look ahead to 31 December. PHP 8.2 reaches end of life at the close of the year. Any supplier on 8.2 needs an upgrade plan regardless of this week's patch.
From annual snapshot to continuous assurance
Every few months, an event like this exposes the same weakness. Supplier assurance built on yearly questionnaires cannot keep pace with vulnerabilities that go from disclosure to exploitation in days. Point-in-time evidence answers last year's questions.
What works is continuous visibility: knowing which suppliers matter most, monitoring them on an ongoing basis across both cyber and business risk, and being able to send targeted questions to the right suppliers the moment an event like this breaks, then tracking their responses to closure.
That is what we built RiskXchange to do. If this week has left you unsure which of your suppliers are exposed, talk to us. We will help you find out.
Sources
By Darren Craig, Founder and CEO, RiskXchange