PHP vulnerability CVE-2026-109618
Versio.io finds every affected PHP version in your IT landscape within minutes – on hosts, in containers and as running processes
In a nutshellRequest demoStart free trialManagement summary
- The risk - CVE-2026-109618 and CVE-2026-109619 allow remote code execution in PHP. This is the highest risk level for web servers and their data.
- The fix - Security updates are available for PHP 8.2 to 8.5. Older release branches must be migrated.
- The challenge - Where in my application landscape is PHP being used, and which version?
- The solution - Versio.io identifies all installed and running PHP installations, their exact versions and the required patches across the entire IT landscape.
Where is PHP used? Complete PHP discovery with Versio.io
What is known about the PHP vulnerability?
- PHP 8.5 - Update to PHP 8.5.12 or higher
- PHP 8.4 - Update to PHP 8.4.27 or higher
- PHP 8.3 - Update to PHP 8.3.36 or higher
- PHP 8.2 - Update to PHP 8.2.35 or higher
- PHP 8.1 and older - These release branches have reached end of life and no longer receive security updates. Migration to a supported release branch is required.
1. Locally installed PHP on servers
1. Locally installed PHP on servers
The most common place for PHP is a package installed on a Linux or Windows server. Versio.io reads the package manager of the operating system (e.g. rpm or dpkg) and the Windows software inventory and records vendor, product and exact version for every package.
- Typical findings - PHP packages such as php-fpm, php-cli or php-common, often in several versions in parallel on the same host.
- Also covered - PHP extensions and versions provided by additional repositories, for example for older applications that still require an outdated release branch.
- Why it matters - Parallel installations are easily overlooked – updating the default version does not close the vulnerability in the second one.
2. PHP in Docker containers and Kubernetes
2. PHP in Docker containers and Kubernetes
In containerised environments, PHP is part of the image – and is therefore invisible to classic software inventories of the host. Versio.io inventories Docker hosts and Kubernetes clusters with their images, containers and pods and also detects the PHP processes running inside the containers.
- Typical findings - Official PHP images such as php:8.4.20-apache or php:8.3.19-fpm-alpine and in-house application images built on them.
- Context - For each affected image, you can see which pods, namespaces and clusters are currently running it.
- Why it matters - Containers are only patched when the image is rebuilt and redeployed. Old images often continue to run unnoticed for months.
3. PHP as a running process
3. PHP as a running process
Not every PHP installation comes from a package manager. Self-compiled versions, PHP bundled with third-party software or appliances and copies in application directories do not appear in any package list. Versio.io therefore also continuously evaluates the running processes of the operating system and determines the version from the command line, the binary path or a version query.
- Typical findings - PHP-FPM master and pool processes, web servers with mod_php, CLI scripts started by cron jobs and binaries such as /opt/php-8.1.9/bin/php.
- Why it matters - This method shows what is actually running in production – including the installations that nobody remembers.
Frequently asked questions
Which PHP versions close CVE-2026-109618 and CVE-2026-109619?
The vulnerabilities are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Installations of these release branches with a lower version are affected. Versio.io automatically shows the appropriate patch version for each installation.
Is Versio.io affected by the PHP vulnerability?
No. The Versio.io platform does not use PHP and is therefore not affected by CVE-2026-109618 or CVE-2026-109619.
Can Versio.io also find PHP in Docker containers and Kubernetes?
Yes. Versio.io detects PHP in locally installed packages, in Docker containers and Kubernetes pods, and as running processes. This also covers installations that were not set up via a package manager.
How quickly can I see which systems are affected?
As soon as the Versio.io agents and importers are connected, the inventory is created automatically. The vulnerability assessment is carried out continuously, so affected PHP versions are visible within minutes.
What about future vulnerabilities?
Versio.io checks all detected software versions every day against more than 600,000 pieces of vulnerability information from various data sources. New vulnerabilities in PHP or any other software are reported automatically – without a new manual survey.
References