If you have observed suspicious activity in your environment, you can report it to AM-CERT by following the instructions available at: https://am-cert.am/report
keyboard_arrow_left
Cybersecurity
Critical Vulnerabilities in PHP
October 22, 2026
Information Systems Agency of Armenia (ISAA) and AM-CERT join cybersecurity authorities in the United States, Europe, Asia, and other parts of the world in warning about two critical vulnerabilities discovered in PHP, a programming language widely used to power websites and online services, including platforms such as WordPress, Nextcloud, Roundcube, and Moodle.
PHP powers nearly 70% of websites worldwide and is widely used to run websites and online services, including platforms such as WordPress, Nextcloud, Roundcube, and Moodle.
The critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 could allow malicious actors to remotely execute code on a server, potentially enabling them to steal data, take a website offline, or gain access to an organization's network.
As of October 22, 2026, these vulnerabilities are being actively exploited by threat actors.
AM-CERT recommends:
- Identify websites and web platforms within your network that run on PHP (e.g., WordPress, Nextcloud).
- Update your PHP version to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.3. If updating is not possible, consider restricting Internet access to the affected systems.
- For web platforms that rely on PHP, wait for the vendor's security update. If no update is available, consider restricting Internet exposure until a patch is released.
- Review your security logs for suspicious PHP processes and unusual outbound network connections.
If you have observed suspicious activity in your environment, you can report it to AM-CERT by following the instructions available at: https://am-cert.am/report