Critical PHP vulnerabilities: what to do today

On 20 October, CERT-EU, the cybersecurity team of the European institutions, published advisory 2026-018. It covers two vulnerabilities in PHP, known as CVE-2026-109618 and CVE-2026-109619. Both have a CVSS score of 9.2. According to the advisory, an attacker may be able to run code on a server through these flaws without logging in first. The PHP team is releasing a security update on 21 October at 14:00 UTC (16:00 Dutch time). Technical details have not been made public yet.

Why this affects your organisation too

PHP is the programming language behind a large part of the web. WordPress runs on it, as do many web shops, customer portals, intranets, webmail and the control panels of hosting packages. According to CERT-EU, all PHP versions from PHP 5 onwards may be affected. So an old website nobody has touched in years counts too.

A flaw that lets an attacker run code without logging in is the kind that gets exploited at scale within days of the patch. Attackers compare the old and new versions and see exactly where the problem was. The time between the update and the first attacks is therefore short.

What to do today

1. Make a list of everything that may run on PHP: your website, web shop, customer portal, webmail and your hosting control panel. Not sure? Ask your web developer or hosting provider.
2. Ask your hosting provider whether and when they will apply the PHP update after 16:00 Dutch time. On shared hosting they usually do it themselves; on your own server or VPS it is often up to you.
3. Install the update as soon as it is available. Do not wait for the next maintenance window.
4. If you cannot update quickly, take the application offline for now or put it behind a login. That is also what CERT-EU advises.
5. Record what you did and when. If your organisation falls under NIS2, or a customer asks for proof of your security, you will have it at hand.

And Stilops itself

Stilops does not use PHP. We checked our code and the way our servers are set up against the advisory, and PHP does not appear in either. For Stilops customers, this flaw therefore changes nothing about the service. For the suppliers we use ourselves, we follow their updates.

A Stilops agent can help with the first step, though: based on what you tell it about your website and systems, it can list what may run on PHP and prepare a message to your hosting provider or web developer for each item. You send it yourself, as always after your approval.