# CERT-FR Warns of PHP RCE Flaws

Published: 2026-10-21 · Severity: severe
Canonical: https://vorant.io/reports/2a8ad648-7ad9-5676-99e3-e02a8fa3139f/cert-fr-warns-of-php-rce-flaws

> CERT-FR advisory details multiple PHP vulnerabilities allowing remote code execution; update to patched 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

CERT-FR has issued an advisory covering multiple vulnerabilities in PHP that could allow an attacker to achieve arbitrary remote code execution. The affected scope spans essentially all legacy PHP branches (5.x, 6.x, 7.x, 8.0.x, 8.1.x) as well as specific 8.2.x, 8.3.x, 8.4.x, and 8.5.x releases prior to the fixed versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 respectively.

Two CVEs are referenced (CVE-2026-109618 and CVE-2026-109619), alongside PHP's own security bulletins and GitHub security advisories (GHSA-6wmf-4rv5-p3rp and GHSA-w8hw-w9fx-j79w) dated October 21, 2026. The advisory does not provide technical details on the vulnerability mechanisms, nor does it indicate whether these flaws are being actively exploited in the wild.

Defenders running PHP should prioritize patching to the fixed versions noted above, particularly for internet-facing applications. Organizations still running end-of-life PHP branches (5.x through 8.1.x) should treat this as an additional driver to migrate to a supported, patched version, since no fixes are provided for those legacy branches.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618 (templated), CVE-2026-109619

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1359

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2a8ad648-7ad9-5676-99e3-e02a8fa3139f/cert-fr-warns-of-php-rce-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup