On October 21, 2026, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution on any PHP installation that serves web requests, including PHP-FPM, Apache with mod_php, and php-cgi. Attackers could use these flaws to take over anything running PHP, from websites to IoT devices on a local network.
We emailed all HostedScan subscribers about these vulnerabilities on the same day. This post tracks when each HostedScan scanner can detect them. We will update the list below as scanner updates pass our testing.
What to do
Update PHP now. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both vulnerabilities. PHP 8.1 and older get no fixes from the PHP project but are still vulnerable. Check with your Linux distribution or LTS vendor for patched packages.
The PHP security advisory has the full details and the temporary mitigations for servers that cannot update right away. The PHP project says the mitigations reduce exposure but do not make an installation safe.
Scanner status
No HostedScan scanner detects CVE-2026-109618 or CVE-2026-109619 yet. Nuclei and Tenable Nessus have detection updates in progress. We will test each update before we release it to HostedScan scans.
Vendor update in progress – A detection test is being developed
- Nuclei
- Tenable Nessus and Tenable Nessus Agent
No detection test yet
- OpenVAS
- Greenbone Enterprise
- ZAP Passive and ZAP Active + Passive
Sources
Speed and power,
without the complexity
The world's leading vulnerability scanners, all in one platform.