Number: AL26-026
Date: October 21, 2026
Updated: October 27, 2026
Audience
This Alert is intended for IT professionals and managers.
Purpose
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
Details
The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting PHPFootnote 1. In response to the vendor advisory, the Cyber centre released an advisory on October 21, 2026Footnote 2.
Tracked as CVE-2026-109618Footnote 3 and CVE-2026-109619Footnote 4, these vulnerabilities are Use After Free vulnerabilities (CWE-416)Footnote 5 affecting multiple versions of PHP. Known as “php2shell”Footnote 6, successful exploitation could allow an unauthenticated threat actor to execute arbitrary code on an affected system. Internet-facing PHP servers and applications are at heightened risk.
The PHP Security Team has released security updates addressing these vulnerabilities. Organizations should identify affected systems and apply the appropriate updates immediately.
PHP remains a widely deployed technology and continues to support a substantial proportion of web applications worldwide.
All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. PHP assess the risk as greatest for mod_php, as a demonstrated exploit allows an unauthenticated request to trigger the vulnerability before application-level code is executed.
The Cyber Centre has observed open-source reporting indicating that a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.
On October 23, 2026, the PHP Security Team published additional information regarding another remote code execution vulnerabilityFootnote 9, tracked as CVE-2026-115560Footnote 10. The vulnerability is not addressed by the security updates released on October 21, 2026.
Successful exploitation of CVE-2026-115560 requires an uncommon combination of PHP configuration and application behaviour. Applications that do not change the serialization handler at runtime are not exposed to this attack vector.
Until a security update is available, the PHP Security Team recommends disabling the session upload progress feature:
session.upload_progress.enabled=0
This mitigation was previously recommended for CVE-2026-109619. Organizations that have already applied this mitigation and kept it in place do not need to take additional action specifically for CVE-2026-115560.
Open-source reporting indicates that CVE-2026-109618 and CVE-2026-109619 are being exploited in the wild.
On October 26, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-109618Footnote 11 and CVE-2026-109619Footnote 12 to their Known Exploited Vulnerabilities (KEV) Database.
Suggested actions
The Cyber Centre strongly recommends that organizations running affected PHP versions upgrade to the following fixed version:
affected PHP versions upgrade
| Affected Product |
Affected Versions |
Fixed Versions |
| PHP |
8.5.x prior to 8.5.12 |
8.5.12 |
| PHP |
8.4.x prior to 8.4.27 |
8.4.27 |
| PHP |
8.3.x prior to 8.3.36 |
8.3.36 |
| PHP |
8.2.x prior to 8.2.35 |
8.2.35 |
Note: versions 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.
The Cyber Centre recommends that organizations:
- Update affected PHP installations immediately to a fixed, supported release.
- Prioritize Internet-facing systems and applications that process untrusted input.
- Identify third-party products, appliances and containers that include vulnerable PHP componentsFootnote 7.
- Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.
- Monitor for potential compromise by reviewing web server, application, authentication, and endpoint logs for suspicious activity.
- Investigate unexpected processes, commands, files, accounts or outbound connections associated with PHP or web-server services.
- Continuously monitor third-party vendors for security updates, including appliances, applications and services that bundle PHP, and apply applicable patches without delay.
Organizations should also review the Cyber Centre’s Top 10 IT Security ActionsFootnote 8.
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.
References