Critical PHP vulnerabilities
Breaking developments, expert insights, and guidance
Stay informed as the threat evolves with the latest TrendAI™ Research, security updates, and resources to help protect your organization.
Everything you need to know
Two critical vulnerabilities in PHP, a programming language widely used to power websites and applications, could allow attackers to execute malicious code on vulnerable systems without authentication.
With public exploit code available, it's critical to identify affected systems and address potential exposure quickly.
At the forefront of investigating these vulnerabilities, TrendAI™ researchers are uncovering emerging risks and helping organizations understand their potential exposure and take decisive action.
The threat at a glance
Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
Severity: Critical (CVSS 9.2)
Potential impact: Unauthenticated remote code execution
Exploit status: Public proof-of-concept code available
Remediation: Security updates available
Research and resources
Access the latest research, technical guidance, and tools to assess your exposure and determine your next steps. Check back for updates as new research, security guidance, and protection resources become available.
Threat analysis
Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now
Explore TrendAI™ Research findings, affected PHP environments, exploitation risks, recommended mitigations, and signs of potential compromise.
PHP vulnerability scanner
Assess your exposure to the critical PHP vulnerabilities with the TrendAI™ PHP vulnerability scanner.
Security advisories and updates
Review official PHP security advisories, affected versions, and available fixes to guide remediation.
Strengthen your defenses with TrendAI™
TrendAI™ provides security capabilities and expert services to help organizations prioritize exposures, protect vulnerable systems, detect potential attacks, and respond to emerging threats.
Identify and prioritize exposures
TrendAI Vision One™ Cyber Risk Exposure Management helps identify exposed assets and prioritize remediation based on risk.
Protect vulnerable systems
TrendAI Vision One™ TippingPoint™, Endpoint Security, and TrendAI™ Deep Security provide virtual patching and intrusion prevention capabilities to help shield vulnerable systems while security updates are deployed. These protections do not replace patching.
Detect and investigate threats
TrendAI Vision One™ Network Detection and Response, Agentic SIEM, and XDR help detect exploitation attempts, investigate suspicious activity, and identify potential signs of compromise.
24/7 threat detection and response
TrendAI Vision One™ Services – Managed Detection and Response provides 24/7 detection, investigation, and response by TrendAI™ security experts.
Connect with a TrendAI™ security expert
Experience the platform for free
Discover how TrendAI Vision One™ helps identify exposures, prioritize risks, and strengthen your defenses.