Skip to main content
عربي
logo

NCSC-TAD-2610-002

Severity Level: Critical
Vulnerability

Reference No.: NCSC-TAD-2610-002CVSS 9.2

Critical PHP Vulnerabilities – Immediate Preparation Required

Threat Type:
N/A
TLP:
CLEAR
CVE:
CVE-2026-109618, CVE-2026-109619

Overview

Bahrain National CERT would like to draw your attention to the two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, associated with a potential risk of unauthenticated remote code execution. Successful exploitation could compromise affected servers and their hosted applications.

The PHP security team has announced that both vulnerabilities are rated Critical (CVSS v4.0: 9.2). A security release is scheduled for 21 October 2026 at 5:00 PM Bahrain time (14:00 UTC). Detailed technical information, affected versions, and fixed versions are expected to be published with the release.

Affected Technologies

  • All PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12

Mitigation and Immediate Actions

  1. 01

    Identify PHP deployments across your environment, including websites, applications, and services managed by third-party hosting providers.

  2. 02

    Prepare to apply the security updates immediately upon availability, prioritizing internet-facing systems.

  3. 03

    Coordinate with application owners and service providers to confirm responsibility for updating the underlying PHP runtime.

  4. 04

    Consider temporarily restricting public access or isolating potentially affected applications where timely patching is not feasible.

  5. 05

    Monitor relevant systems and logs for suspicious activity and report any suspected compromise to Bahrain National CERT through established reporting channels.

  6. 06

    Please share this advisory with your IT operations, application development, and security teams for urgent assessment and action.

References