PHP fixes are available: update the runtime on the server

The flaws are in PHP itself

The UK NCSC describes two memory-management flaws. CVE-2026-109618 can interrupt processing while internal request data is only partly initialized; CVE-2026-109619 can leave stale state for a later request to use. Under certain conditions, this corruption can allow remote code execution without authentication.

Cloudflare says it has observed attack traffic and deployed protections. That is the operator’s report, not evidence that every PHP server has been compromised. The NCSC also calls for finding PHP inside third-party software and appliances, not just websites you manage directly.

On 22 October, CERT-FR added that it knows of proofs of concept for both CVEs in specific PHP deployments. A public proof of concept alone does not prove your server is compromised; it is another reason to check the fix without delay.

CERT/CC highlights Apache mod_php in particular: proof-of-concept exploitation shows unauthenticated requests triggering the attack before application code runs. A control implemented only inside the CMS cannot address that path by itself.

Upstream versions and distribution packages need different checks

CERT-FR lists the following PHP branches as affected below these fixed releases. These are upstream versions; a package maintained by a Linux distribution may have a different version number.

Ubuntu adds USN-8948-2 for 20.04 LTS and 18.04 LTS with Ubuntu Pro, and for 16.04 LTS and 14.04 LTS with Ubuntu Pro and the Legacy Support add-on. These distribution fixes exist even where the upstream PHP branch is no longer maintained. Debian lists php8.4 8.4.27-1~deb13u1 for trixie in DSA-6574-1. Check the package and support entitlement that actually apply to your system.

QNAP: fixed NAS releases are still being prepared

QNAP published QSA-26-18 on 22 October for both PHP CVEs. It marks affected products as “Fixing” and their fixed versions as “To be announced.” An upstream PHP fix therefore does not mean your NAS firmware already includes it.

The table below reproduces the listed operating systems. The advisory also names several applications and appliances; its entry for QVR Surveillance 3.0.3 and earlier specifically applies to ARM32 models. Check each component’s name and version directly in the advisory.

Until fixes arrive, QNAP says to stop exposing the device directly to the internet: remove port forwarding and UPnP, restrict administration to trusted local or VPN networks, and stop unnecessary services. Disabling the web server does not protect the administration interface. Already compromised local devices remain a risk.

QNAP says its updates do not cover PHP inside Container Station containers or third-party applications. Contact the image or application provider. The vendor says it has received no reports of exploitation targeting its products; that does not guarantee no device has been affected. We have not tested these mitigations.

Synology: fixed packages, but not for PHP 7.3

Synology-SA-26:14, published on 22 October, names both CVEs and provides updates for the PHP packages below, Mail Station and Synology Calendar. These are package versions, not simply upstream PHP numbers. PHP 7.3 is end-of-life and will not receive a fix; do not wait for a package the vendor says it will not provide.

The vendor separately describes the PHP built into the operating system as unexposed to external attack surfaces, with a very low exploitation risk. That assessment does not cover every installed NAS package. Check each application in Package Center and the advisory rather than treating one DSM update as proof that everything is fixed.

Check the runtime actually serving the website

Identify who maintains PHP: you, your hosting provider or the vendor of a product that embeds it. Apply the appropriate fix, then check the runtime used by the web service. The version shown in a terminal may not be the one serving the site. A CMS update alone does not establish that PHP has been patched.

For managed hosting, give the provider both CVE identifiers and ask it to confirm the applied fixes. If you run the service, keep a usable backup and check its operation after the update. SecuFocus has not tested these packages or reproduced the attacks.

Cisco has opened an investigation across its products and services. “Products Under Investigation” does not mean every listed product is vulnerable or already patched. Where PHP is embedded in an appliance, obtain the vendor’s confirmation and procedure rather than replacing its runtime yourself.

Cisco advisory revision 1.4, dated 22 October at 23:00 GMT, now confirms Ultra-Reliable Wireless Backhaul (URWB), Expressway and Expressway Select as affected. For URWB, exploitation requires an attacker already authenticated as an administrator; Cisco estimates release 27.1.1 for February 2027. The target for both Expressway families is 15.5.21, with no date yet. These planned version numbers do not establish that a fix is available.

Umbrella and ISE are listed as confirmed not vulnerable, but ISE Portal Builder remains under investigation. Do not treat those last two entries as the same product status. Other products and services remain under review; Cisco states that no workaround addresses these vulnerabilities.

NCSC now explicitly prioritises Internet-facing systems, followed by internal systems. Discovery should therefore not stop at public websites: identify PHP installations used inside the network too.

• Self-hosting: plan for patches and backups↗
• Node.js: check the application runtime too↗

A WAF does not replace the patch

Cloudflare distinguishes its protection layers: the new Free rules require no activation, while Professional, Business and Enterprise customers should check that their Managed Ruleset is deployed in block mode. The new response firewall is described as automatically deployed on all plans; check its presence under Security > Security Rules. None of these layers replaces the PHP fix.

CERT-FR now identifies disabling upload-progress as reducing the attack surface for CVE-2026-109619, not both flaws, and says its temporary workarounds are not qualified. If neither patching nor appropriate mitigation is possible quickly enough, NCSC recommends considering taking the system offline until protected. A partial workaround must not become a permanent repair.

CERT/CC details temporary measures for both flaws, to be applied together, and requires worker restarts for some changes. Some recommendations move memory limits to the system or container. Do not copy an isolated setting from that advisory; have the complete approach checked for your deployment. These mitigations do not provide complete protection.