A PHP security flaw, affecting the language that powers a large share of business websites and applications, is rated 9.8 out of 10 according to the NVD listing. The sources reviewed report no exploitation to date, but a technical demonstration is publicly available according to the Canadian Centre for Cyber Security. Ask your hosting provider this week which version of PHP you’re running.
What is it?
CVE-2026-109618 is an internal flaw in PHP, published by the NVD on October 21, 2026. When the server (the computer hosting your site) runs low on memory, it can end up executing instructions from outside sources.
According to the NVD listing, when PHP runs out of available memory, it abruptly cuts off the request it was handling. The cleanup that follows then relies on memory left in an undetermined state. It’s a bit like locking up the cottage in a hurry: the door gets locked, but papers are left scattered on the table, and whoever arrives next trusts what’s there. If someone slipped in their own instructions, those are the ones that get followed. This is what the NVD means by remote code execution: the ability to run your own programs on someone else’s server.
Why is it serious?
Two very high severity scores, and a scenario ranging from service outages to access to your customers’ data.
The NVD listing shows two scores: 9.8 out of 10 under CVSS 3.1, assigned by NIST (NVD), and 9.2 out of 10 under CVSS 4.0, assigned by the reporting organization (CNA). CVSS is the standard severity scale. At this level, the business translation is straightforward: an order site going offline, customer records becoming readable, access used to set up wire transfer fraud. The sources reviewed report no actual attack, and a published demonstration is not the same thing as one.
Who is affected?
Any organization whose website or application relies on PHP, published by PHP Group.
The exact versions affected are not listed in the facts available to us, and no patched version is specified either. Advisory AL26-026 from the Canadian Centre for Cyber Security was updated on October 23, 2026. It covers this flaw along with CVE-2026-109619, and that’s where your provider will find the affected versions and the recommended steps. PHP runs behind all kinds of things: a retailer’s online store, a clinic’s appointment portal, an accounting firm’s intranet (its internal site reserved for employees).
How do I check my business?
A few questions, asked to the right people, are enough.
- Ask your IT provider whether your websites and applications use PHP, and which version.
- Ask your hosting provider, the company that rents and maintains the computers where your sites live, whether a patched version is available and when it will be applied, then have the answer put in writing (management).
- Have your provider check advisory AL26-026 from the Canadian Centre for Cyber Security for the affected versions.
- Have it confirmed that your backups are recent and that a restore has already been tested.
Scenario
Fictional example: a dental clinic whose appointment portal hasn’t been updated.
The portal runs on a rented server, maintained by a freelance developer who stops by once a year, and the advisory goes unnoticed. One morning, it starts refusing connections and sending out strange emails. The front desk switches back to managing the schedule by phone and calls patients back one by one. Then come the hard questions about who could have accessed the records, and whether affected individuals need to be notified.
What to do now
- List your websites and applications, along with their hosting provider and technical contact.
- Check the PHP version used by each one, with your provider.
- Have it checked whether a patched version is available, then deploy it, starting with anything accessible from the internet.
- Take offline any PHP applications that don’t need to be internet-facing, and test a backup restore.
- Keep tracking advisories from PHP Group and the Canadian Centre for Cyber Security, and follow up again on deployment progress.
PHP Security Flaw: What This Means for Quebec Businesses
For a Quebec organization, the stakes go beyond the technical fix. If personal information is affected, Law 25 requires keeping a register of confidentiality incidents. Where there is a risk of serious harm, it also requires notifying the Commission d’accès à l’information (Quebec’s privacy regulator) and the affected individuals. There is no absolute protection, and no provider can guarantee zero risk: be wary of anyone who promises total protection. Deploying the patched version as soon as it’s available significantly reduces exposure; tested backups, for their part, are what let you resume operations if an incident occurs.
FAQ
I don’t have a website. Does this affect me?
Possibly, without realizing it. Customer portals, billing tools, intranets, and software installed on your premises can all run on PHP. Ask your software vendors.
Should I wait for the patch before doing anything?
No. Taking inventory, checking versions, reducing internet exposure, and testing a restore can all be done right away. Also have someone check with PHP Group and advisory AL26-026 to see whether a patched version is available.
Is a public proof of concept the same thing as an attack?
No, and the distinction matters. A published technical demonstration shows that the flaw can genuinely be exploited, but no attack appears in the sources reviewed. We have no basis for saying whether attempts will follow. It’s like a lock flaw demonstrated in public: you change the lock without waiting to find out.
Sources
- CVE-2026-109618 record from the National Vulnerability Database · NIST, October 21, 2026
- Canadian Centre for Cyber Security: AL26-026 – Critical vulnerabilities affecting PHP – CVE-2026-109618 and CVE-2026-109619 – Update 1 · Canadian Centre for Cyber Security, October 23, 2026
- Commission d’accès à l’information du Québec · obligations, incident register, and notification
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · baseline checklist
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-109618
This article was prepared by RISS Canada’s monitoring team based on the public sources cited above, with the assistance of artificial intelligence tools, and reviewed according to our editorial policy.
