Critical PHP Security Alert: Devices, Applications and Websites

Two critical PHP vulnerabilities disclosed today require urgent attention across business technology. PHP can power websites and business applications, and it can also be bundled into devices and appliances that provide browser-based login or management pages. Affected software needs a security update; the announcement itself does not mean a device or system has been compromised.

For Northeast IT Managed Clients

Our team is actively monitoring this issue for our managed clients. Any impacted devices will be patched as soon as vendor updates are made available.

If you have questions about a managed device or application, contact your usual Northeast IT support channel. Share the product name, model, and software or firmware version if available. Do not send passwords by email.

Why This Extends Beyond Websites

Some devices include PHP behind their built-in web interfaces. That means a login page, administration console, or other page on an appliance may need attention even if your company does not operate a PHP website. The UK National Cyber Security Centre’s guidance specifically includes appliances and services that bundle PHP.

A web interface alone does not prove that a product uses PHP or is vulnerable. The manufacturer must confirm the impact for the exact product and software version. A login requirement is also not sufficient evidence of protection: some vulnerable PHP processing can occur before application login checks run.

The issues are CVE-2026-109618 and CVE-2026-109619, both rated critical at 9.2 under CVSS v4.0. They involve PHP memory handling and can permit unauthenticated code execution with the permissions of the PHP process. The impact on a particular appliance depends on how its manufacturer uses PHP. Technical details are in the first PHP advisory and second PHP advisory.

What Businesses Should Do

1. Identify potentially affected systems. Include business applications, devices, appliances, and externally hosted services that use or bundle PHP. Prioritize services reachable from the internet, while also reviewing internal systems. If your line-of-business software vendors have not already contacted you, reach out to ask whether their products use affected PHP versions and what updates or actions they recommend.
2. Check the manufacturer’s advisory. Confirm the exact model and firmware or software version. For devices, install the vendor-supported firmware or software update; do not replace an embedded PHP component independently. Managed clients should coordinate with Northeast IT.
3. Reduce exposure while awaiting a fix. Have the responsible IT team restrict unnecessary access to administrative interfaces and follow the vendor’s temporary guidance. If an affected service cannot be patched promptly, discuss isolation or temporary shutdown. These steps do not replace patching.
4. Verify the result and report unusual behavior. Administrators should confirm the deployed fix, complete any required restart, and test important functions. Unexpected accounts, redirects, or unexplained configuration changes need investigation. A successful update does not rule out earlier compromise.

For Your Company Website

Northeast IT does not manage client websites. Contact your website developer or hosting provider directly and ask them to confirm that both vulnerabilities have been addressed in the PHP software actually serving your site. Updating WordPress, themes, or plugins alone does not fix the underlying PHP vulnerabilities. WordPress has issued its own urgent notice.

Patch Reference for Administrators

For systems where PHP is managed directly, the minimum fixed upstream releases announced today are:

These are PHP version numbers, not appliance firmware requirements. Vendors may backport the fixes while retaining an older version number; obtain explicit confirmation covering both CVEs for the installed package or product. PHP 8.1 and earlier require a verified vendor fix or migration to a supported release. See PHP’s official update guidance.

Further Reading

For an accessible overview and more detailed technical information, see these official resources:

• NCSC: Critical security issue affecting PHP — an overview of the issue and steps organizations should take, including checking appliances and services that bundle PHP.
• MS-ISAC: PHP security advisory and recommended actions — affected software, risk considerations, and remediation guidance from the Center for Internet Security.
• WordPress: Critical PHP security release — guidance for website owners on checking their hosting environment and arranging an update.
• PHP: Official security update guidance — fixed PHP releases and technical remediation information from PHP’s maintainers.
• Official CVE records: CVE-2026-109618 and CVE-2026-109619. The PHP maintainer advisories linked earlier in this post provide additional technical detail.

Questions About Your Business Technology?

Contact Northeast IT through your usual support channel, call 413-736-6348, or use our contact page for questions about managed devices and applications. Your website developer or hosting provider remains the contact for website remediation.

This guidance reflects information available on October 21, 2026. Product impact and update availability may change as vendors complete their assessments.