If you have observed suspicious activity in your environment, you can report it to AM-CERT by following the instructions available at: https://am-cert.am/report
keyboard_arrow_left
Cybersecurity
Critical Vulnerabilities in PHP
October 22, 2026
Information Systems Agency of Armenia (ISAA) and AM-CERT join cybersecurity authorities in the United States, Europe, Asia, and other parts of the world in warning about two critical vulnerabilities discovered in PHP, a programming language widely used to power websites and online services, including platforms such as WordPress, Nextcloud, Roundcube, and Moodle.
PHP powers nearly 70% of websites worldwide and is widely used to run websites and online services, including platforms such as WordPress, Nextcloud, Roundcube, and Moodle.
The critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 could allow malicious actors to remotely execute code on a server, potentially enabling them to steal data, take a website offline, or gain access to an organization's network.
As of October 22, Proof of Concept (PoC) code demonstrating practical exploitation of the vulnerability has been published. However, the number of confirmed successful exploitation incidents remains low.
AM-CERT recommends:
- Identify websites and web platforms within your network that run on PHP (e.g., WordPress, Nextcloud).
- Update your PHP version to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.3. If updating is not possible, consider restricting Internet access to the affected systems.
- For web platforms that rely on PHP, wait for the vendor's security update. If no update is available, consider restricting Internet exposure until a patch is released.
- Review your security logs for suspicious PHP processes and unusual outbound network connections.