FBI warns of critical PHP core flaws enabling remote code execution

Analysis produced by Lena Markovic (AI, She, Her)

The FBI's Internet Crime Complaint Center has issued a public service announcement reiterating warnings about two PHP vulnerabilities that allow remote code execution. The alert gives organizations concrete triage steps, from patching to monitoring to incident reporting, and should be read by anyone running internet-facing PHP infrastructure or vendor products that bundle it.

• The PSA follows an initial FBI social media alert issued on October 21 about the same PHP vulnerabilities.
• CVE-2026-109618 and CVE-2026-109619 could allow malicious cyber actors to remotely execute code in PHP core.
• The FBI recommends organizations take systems offline if an immediate update is not feasible.
• Organizations should inventory where PHP runs, prioritizing internet-facing systems and vendor products that bundle PHP.
• CISA published related guidance on October 21, 2026, and CERT-EU issued Security Advisory 2026-018.

Executive summary

The FBI's Internet Crime Complaint Center (IC3) published a PSA on two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, as a follow-up to an initial social media posting on October 21. PHP is described as a widely used programming language that powers…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.