On 21 October 2026 the PHP project released security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. CERT-EU had already warned about them a day earlier. Both have a CVSS 4.0 score of 9.2 and, according to the PHP project, can lead to remote code execution without an attacker having to log in.
What is going on?
Both vulnerabilities revolve around memory that is not properly cleaned up between consecutive requests. In the first, memory is left in an uninitialised state after an out-of-memory condition; in the second, internal global state still points to memory that has already been freed. A subsequent request can then work with it. The attack is not trivial (CVSS: high attack complexity and specific preconditions), but the PHP project is clear: there are no complete mitigations, updating is the only safe choice.
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Why this also affects OT
PHP is not a typical OT component, but it appears in OT environments more often than you might think:
- Web management interfaces of gateways, industrial routers and some controllers and HMI panels.
- Supporting systems around the process, such as reporting and monitoring tools on Windows or Linux servers in the OT DMZ.
- Older firmware, which often contains a PHP version that is no longer supported by the PHP project. No update will come from the PHP project for those versions; only the device vendor can then supply new firmware.
Whether a specific device is vulnerable depends on the PHP version and the way the product uses PHP. That is for the vendor to determine, and those advisories usually follow days or weeks later.
What can you do now?
- Take inventory of which systems and devices in your environment use PHP, including in web management interfaces. A current asset inventory helps here.
- Patch servers you manage yourself to one of the versions above.
- Restrict access to web management interfaces to a separate management segment, especially while an update is not yet available. A web interface of OT equipment should never be directly reachable from the internet.
- Follow the vendor advisories. As soon as vendors report which products are affected, they appear in IACS Radar under the relevant vendor and product — follow them via My Radar.
The PHP CVEs themselves are not in the IACS Radar vulnerability list, because PHP is not an OT vendor. The vendor reports about affected OT products are.
Sources: CERT-EU Security Advisory 2026-018, php.net and the NVD records of CVE-2026-109618 and CVE-2026-109619.