Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

Executive Summary Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.

At the time of publication, Palo Alto Networks Cortex Xpanse has identified the presence of over 22.6 million exposed instances potentially vulnerable to CVE-2026-109618 and CVE-2026-109619 based on our telemetry.

Vulnerabilities Discussed CVE-2026-109618, CVE-2026-109619 Palo Alto Networks Product Protections for CVE-2026-109618 and CVE-2026-109619 Palo Alto Networks customers can leverage several product protections and updates to identify and defend against these vulnerabilities.

Cortex Cloud and Prisma Cloud Cortex Cloud and Prisma Cloud help detect vulnerable PHP versions in code and cloud environments providing both posture and vulnerability protections.

Additional Resources Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products — Advisory, Palo Alto Networks Millions of PHP Instances Exposed: What Organizations Need To Do Right Now — Lee Klarich, Palo Alto Networks Security advisory: Critical remote code execution vulnerabilities, update now - PHP Updated October 21, 2026, at 9:30 a.m. PT to add Palo Alto Networks security advisory, update links in additional resources, and update product protection section.