Knowledge base
Knowledge base
Breadcrumbs

Critical PHP Remote Code Execution Vulnerabilities

Last updated: 2026-10-23

This page is being updated continuously

Critical Vulnerabilities in PHP

Two critical PHP vulnerabilities has been announced; CVE-2026-109618 and CVE-2026-109619. They have a CVSS v3.1 base score of 9.8 (Critical) for CVE-2026-109618; both have a CVSS v4.0 rating of 9.2. They allow unauthenticated remote code execution and memory exposure.

Because they affect PHP itself, applications and websites that rely on PHP, including platforms such as WordPress, may also be affected.

Organisations operating PHP-based applications, particularly internet-facing systems, should review their exposure and be prepared to apply the official PHP security updates.

Outpost24 or Specops Products are not Affected

No Specops or Outpost24 products use PHP. Additionally, we have confirmed that Specops and Outpost24 administration consoles, customer and support portals, licensing and registration sites, and APIs are not affected by the vulnerabilities.

We have also reviewed our third-party suppliers and sub-processors and have not identified any related issues that would pose a concern for Specops or Outpost24 customers.

Our public websites, specopssoft.com and outpost24.com, were affected. Both are standalone sites hosted by a third-party vendor and completely isolated from our core product environments. As a precaution, we took both offline immediately upon identifying the vulnerabilities. Following patching by our hosting provider, both sites have been fully restored as of the evening of October 21st.

We recommend you to:

  • Identify systems running PHP and determine which PHP versions are currently in use.

  • Prioritise internet-facing PHP applications, including WordPress websites and other publicly accessible services that rely on PHP.

  • Apply the official PHP security updates as soon as the relevant updates are available.

  • Upgrade unsupported PHP versions to a currently supported release. PHP recommends upgrading end-of-life releases as they may be exposed to unpatched security vulnerabilities.
    PHP supported versions

  • Where patching cannot be performed immediately, consider temporarily reducing or isolating external exposure until remediation can be completed.

Identifying PHP Exposure with Outpost24:

EASM

Customers using Outpost24 External Attack Surface Management (EASM) can use the platform to help identify internet-facing sites where PHP has been detected.

A banner has been deployed in the platform that filters the customer's scope to display sites containing PHP. This can help you quickly identify assets that may require further investigation and prioritise them for verification and remediation.

Assets without a detected PHP version are included in the dashboard for visibility. These assets are flagged as potentially vulnerable because the version couldn't be determined. Each asset should be reviewed to confirm they have been patched.

ASM/RBVM

Customers using Outscan or HIAB can use their vulnerability scanning results to identify PHP installations and related findings. Netsec scanning identifies vulnerabilities based on detected software versions and patch information.

Detection may depend on the information exposed by the target. If sufficient version information is not available during an unauthenticated scan, it may not be possible to determine whether a particular PHP version is affected. Where appropriate, authenticated scanning can provide additional software and version visibility.

On the evening of October 22nd, we released improvements to the unauthenticated detection that helps identify indicators on the server suggesting that the corresponding security update has not yet been applied. While the script provides additional coverage, there are currently a number of hardened configurations that it may not detect.

Pentesting

Our pentesting team has developed a script to check applications covered by active SWAT, DAST Expert, Snapshot or Assures services for potential exposure to php2shell, using the exploitation techniques published during the night between 21 and 22 October 2026.

If you are affected, findings will be published as they are identified and reviewed by the team. Note that the absence of published findings does not mean that the underlying applications are unaffected. Exploitation attempts may have been prevented by protective measures or patches implemented by providers such as Cloudflare or WP Engine.

Additional exploitation techniques may emerge, so we strongly recommend upgrading affected PHP installations to a patched version as soon as possible, even where current testing has not demonstrated exploitability.

Verify Affected Versions

Full details regarding affected and fixed PHP versions should be verified against the official PHP security release before concluding whether a particular system is vulnerable.

PHP currently lists PHP 8.2, 8.3, 8.4 and 8.5 as supported branches. PHP 8.2 is currently in security-fixes-only support, while PHP 8.3, 8.4 and 8.5 have later security-support end dates. [php.net]

Outpost24 recommends treating remediation of confirmed affected systems as a priority.

References