Back to advisories
HIGH CVSS 9.2 (v4.0) CERTFR-2026-AVI-1359

Multiple vulnerabilities in PHP

Published 21/10/2026 Source : CERT-FR

Description

Multiple vulnerabilities have been discovered in PHP. They allow an attacker to execute arbitrary code remotely.

Impacts

  • Remote arbitrary code execution

Solutions

Refer to the vendor's security bulletin to obtain the patches (see the Documentation section).

Affected Products (1)

PHP · PHP
Affected versions : PHP toutes versions 6.x
PHP toutes versions 8.0.x
PHP versions 8.2.x antérieures à 8.2.35
PHP versions 8.5.x antérieures à 8.5.12
PHP toutes versions 8.1.x
PHP toutes versions 7.x
PHP versions 8.4.x antérieures à 8.4.27
PHP versions 8.3.x antérieures à 8.3.36
PHP toutes versions 5.x

Vulnerabilities (CVE) (2)

CVE-2026-109618 CVE-2026-109619

Information

Severity
HIGH
CVSS v4.0
9.2 / 10
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Risk Indicators
? Exploit in Wild ? PoC Public ✗ CISA KEV ✓ Patch Available ? Workaround
Source
CERT-FR CERTFR-2026-AVI-1359
External Link
View Source ↗
Published
21/10/2026
Officially Updated
21/10/2026
Added to OpenVOC
21/10/2026 18:00
Last updated
21/10/2026 19:00
Sign in to see whether your assets are affected and to receive group notifications.