Affected Systems
PHP (all widely-deployed versions; specific affected versions not disclosed in advisory). Over 22.6 million exposed instances identified via Cortex Xpanse telemetry. Affects web servers and content management systems globally.
Exploitation Status
Proof-of-concept code exists. At least one European government took its website offline as a precaution. No confirmed active exploitation reported at time of publication, but risk is elevated given PoC availability and massive exposure.
Business Impact
Two remote code execution vulnerabilities (CVSS 4.0: 9.2) allow attackers to execute arbitrary code via memory corruption during error handling. CVE-2026-109618 exploits uninitialized memory after out-of-memory errors; CVE-2026-109619 exploits use-after-free conditions in global memory. Given PHP's ubiquity in web infrastructure, successful exploitation enables full server compromise, data theft, and lateral movement. Massive attack surface with 22.6M+ potentially vulnerable instances.
Urgency
🔴 Immediate
Recommended Actions
- Apply PHP Group security patches immediately for all PHP installations per official advisory
- Identify all internet-facing PHP instances using asset discovery tools (e.g., Cortex Xpanse, Shodan, internal scans)
- Deploy virtual patching via Advanced Threat Prevention Plus with Frontier (Threat ID 543004) or equivalent IPS/WAF rules if patching cannot be completed within 24 hours
- Monitor web server logs and EDR telemetry for unusual PHP process behavior, unexpected memory errors, or post-exploitation activity
- For critical systems that cannot be patched immediately, consider temporary service isolation or taking systems offline until patching is complete