Security Awareness: Critical PHP Remote Code Execution Vulnerabilities
Two critical PHP vulnerabilities has been announced; CVE-2026-109618 and CVE-2026-109619. They have a CVSS v3.1 base score of 9.8 (Critical) for CVE-2026-109618; both have a CVSS v4.0 rating of 9.2. They allow unauthenticated remote code execution and memory exposure.
Because they affect PHP itself, applications and websites that rely on PHP, including platforms such as WordPress, may also be affected.
Organisations operating PHP-based applications, particularly internet-facing systems, should review their exposure and be prepared to apply the official PHP security updates.
Specops and Outpost24 Products are not Affected
No Specops or Outpost24 products use PHP. Additionally, we have confirmed that Specops and Outpost24 administration consoles, customer and support portals, licensing and registration sites, and APIs are not affected by the vulnerabilities.
We have also reviewed our third-party suppliers and sub-processors and have not identified any related issues that would pose a concern for Specops or Outpost24 customers.
Our public websites, specopssoft.com and outpost24.com, were affected. Both are standalone sites hosted by a third-party vendor and completely isolated from our core product environments. As a precaution, we took both offline immediately upon identifying the vulnerabilities. Following patching by our hosting provider, both sites have been fully restored as of the evening of October 21st.
Recommended Actions
We recommend you to:
- Identify systems running PHP and determine which PHP versions are currently in use.
- Prioritise internet-facing PHP applications, including WordPress websites and other publicly accessible services that rely on PHP.
- Apply the official PHP security updates as soon as the relevant updates are available.
- Upgrade unsupported PHP versions to a currently supported release. PHP recommends upgrading end-of-life releases as they may be exposed to unpatched security vulnerabilities.
PHP supported versions - Where patching cannot be performed immediately, consider temporarily reducing or isolating external exposure until remediation can be completed.
Verify Affected Versions
Full details regarding affected and fixed PHP versions should be verified against the official PHP security release before concluding whether a particular system is vulnerable.
PHP currently lists PHP 8.2, 8.3, 8.4 and 8.5 as supported branches. PHP 8.2 is currently in security-fixes-only support, while PHP 8.3, 8.4 and 8.5 have later security-support end dates. [php.net]
Specops and Outpost24 recommends treating remediation of confirmed affected systems as a priority.
Need further information?
Raise a support ticket with our Specops support team at https://support.outpost24.com or email support@outpost24.com.