Forwarded National Information and Analysis Center for Cyber Security Cybersecurity Information Alert NICS-ANA-2026-0000952

[Description]
Researchers have discovered Use After Free vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP. Attackers can send specially crafted multipart/form-data HTTP requests to execute arbitrary code at the server level without authentication. Proof-of-Concept (PoC) code for these vulnerabilities has appeared online. Please confirm and take action as soon as possible.

[Affected Platforms]
Versions that have reached End of Life (EOL): All versions of PHP 5.4.x to 5.6.x All versions of PHP 7.0.x to 7.4.x All versions of PHP 8.0.x to PHP 8.1.x

Versions still supported by the official vendor: PHP versions 8.5.11 and earlier PHP versions 8.4.26 and earlier PHP versions 8.3.35 and earlier PHP versions 8.2.34 and earlier

Note: The underlying architecture of content management systems such as WordPress, Drupal, Joomla, and Magento often relies on PHP. It is recommended to inventory affected systems and take action as soon as possible.

[Recommended Measures]
The official vendor will release patches or updates for the vulnerabilities. System administrators are advised to upgrade PHP to the latest supported secure versions listed below as soon as possible: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35

Official update announcements and download URL:https://www.php.net/downloads.php

Note: PHP 8.1 and earlier versions have reached End of Life (EOL) and will not receive official patches or updates. It is recommended to upgrade to one of the supported versions listed above as soon as possible.

[References]
1. https://nvd.nist.gov/vuln/detail/CVE-2026-109618
2. https://nvd.nist.gov/vuln/detail/CVE-2026-109619
3. https://www.php.net/archive/2026.php#2026-10-20-1
4. https://www.php.net/downloads.php