Magna5 Cybersecurity Notification: Advance Notice of Critical PHP Vulnerabilities Pending Patch Release

Investigating
Updated

Update: PHP Security Updates Available

Magna5 is providing an update regarding the critical PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.

The PHP project has released security updates addressing these vulnerabilities. Customers running PHP should review the official PHP guidance and apply the appropriate updates as soon as possible, prioritizing externally facing websites and internet-accessible systems.

For customers with Magna5 Cybersecurity services, Magna5 is reviewing available telemetry to help identify customers who may be running PHP. Magna5 is also reviewing applicable protections for customers with Managed Firewall and Web Application Firewall services. These protections may help reduce exposure but should not be considered a substitute for patching.

If an internet-facing system cannot be patched promptly, customers should consider disconnecting it from the internet or shutting it down until it can be patched.

If you have any questions or believe your environment may be affected, please contact cybersecurity@magna5.com.

Additional Information

Investigating

Magna5 is providing advance notice of two newly disclosed critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. Public reporting indicates these vulnerabilities may allow remote code execution in affected PHP environments.

At this time, the PHP security team has announced that patches are expected to be released today. Impacted and fixed versions have not yet been fully confirmed.

What is it?

PHP is a widely used programming language that supports many websites, applications, hosting platforms, and vendor-provided software. Because PHP is commonly embedded in web applications and supporting platforms, organizations may have PHP installed in both obvious and less visible locations.

These vulnerabilities are rated critical by PHP. If exploitable in a customer environment, remote code execution could allow an attacker to run unauthorized commands on an affected system. No confirmed workaround is currently available.

What should customers prepare to do?

Customers should prioritize preparation for externally facing websites and internet-accessible systems first.

Recommended preparation steps include:

  • Identify externally facing websites, web servers, applications, and vendor platforms that may be accessible from the internet.
  • Determine whether those systems are running PHP, including PHP bundled inside vendor-managed software, hosting platforms, control panels, or web applications.
  • Inventory PHP versions across internet-facing systems first, then internal systems.
  • Identify systems running end-of-life PHP versions, as these may not receive security fixes.
  • Prepare to patch as soon as vendor updates are available, prioritizing internet-facing systems first.
  • Review vendor and hosting provider guidance, especially where PHP is bundled into third-party applications or appliances.
  • If an internet-facing system cannot be patched promptly, consider disconnecting it from the internet or shutting it down until it can be patched.

There is currently no confirmed workaround other than removing affected systems from internet exposure or powering them down until patching is possible.

What is Magna5 doing?

Magna5 is monitoring developments related to these vulnerabilities and reviewing available threat intelligence as additional details become available. As patches, affected versions, and technical indicators are confirmed, Magna5 will continue to assess the information and update customers as appropriate.

For customers with Magna5 Cybersecurity services, Magna5 is reviewing available telemetry to help identify customers who may be running PHP in their environments.

For customers with Magna5 Managed Firewall services, Magna5 is reviewing client firewall protections, including applicable intrusion prevention system protections where available and appropriate.

For customers with Magna5 Web Application Firewall services, Magna5 is also reviewing available rule protections intended to help block attempted exploitation activity.

These protections may help reduce exposure, but they should not be considered a substitute for patching. Customers should still prepare to apply vendor patches as soon as they become available.

Customer Action

Customer preparation is recommended at this time. Customers should be ready to apply patches as soon as they are released and validated by PHP, operating system vendors, hosting providers, or application vendors.

If you have any questions or believe your environment may be affected, please contact cybersecurity@magna5.com.

Additional Information

For additional background, customers may reference the following article:

Began at:

Affected components
  • General Cybersecurity & Maintenance Notifications