CVE-2026-109618 and CVE-2026-109619 (PHP) — Advisory

Published: [October 23, 2026]

CVE ID: CVE-2026-109618, CVE-2026-109619

Severity: Critical (CVSS v4.0 9.2, as rated by the PHP project)

Absolute product status: Not affected

Overview

On October 21, 2026, the PHP project released security updates for two critical vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution through web requests, and they affect PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Absolute Security has assessed its products and services. Absolute products do not use PHP and are not affected by these vulnerabilities. No action is required for your Absolute products.

Key Facts:

  • Absolute Secure Endpoint, Absolute Resilience for Automation (RfA), Absolute Resilience for Security (Rfs), Syxsense; Absolute Secure Access (cloud and self-hosted) and Absolute Insights for Network; and FirmGuard do not use PHP and are not affected.
  • The PHP project states there is no complete mitigation for these vulnerabilities. Updating to a fixed release is the only safe option for affected systems.
  • On Windows, the PHP fix ships as a zip archive, not an installer or automatic update, and copies of PHP can sit in individual user profiles. Affected installations are easy to miss.

Recommended Remediation

  • For Absolute products, no action is required.
  • For PHP in your own environment, update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older receive no fixes from the PHP project; use a vendor backport or upgrade. If you cannot update immediately, the PHP project has documented interim configuration changes in its security advisory. These reduce exposure but do not make an installation safe.
  • For Absolute Secure Endpoint customers, the ’Detect PHP2Shell vulnerabilities on a Windows or Mac device’ Reach script detects PHP installations and versions across your Absolute-managed devices.
  • For Absolute Resilience for Automation, Absolute Resilience for Security and Syxsense customers, published detection and patching content is available to find affected devices and apply the fixed release.

References