Affected systems
Three layers: the PHP versions, the ways PHP is attached to a web server, and the software that runs on top. The first two come from the PHP project. The third comes from NCSC-NL's public inventory, which this site counts rather than quotes: 674 products at commit cca173c64ec5, of which 206 are marked vulnerable to CVE-2026-109618, 46 fixed, 418 under investigation and 3 not vulnerable.
Versions
| Branch | Affected | Fixed | In the CVE record |
|---|---|---|---|
| 8.5 | < 8.5.12 | 8.5.12 | yes |
| 8.4 | < 8.4.27 | 8.4.27 | yes |
| 8.3 | < 8.3.36 | 8.3.36 | yes |
| 8.2 | < 8.2.35 | 8.2.35 | yes |
| 8.1 | end of life; minimal source backport branch PHP-8.1-CVE-2026-109618-109619 | no release | no |
| 8.0 | end of life; minimal source backport branch | no release | no |
| 7.4 | end of life; minimal source backport branch PHP-7.4-CVE-2026-109618-109619, commit 2026-10-18T18:10:24Z | no release | no |
| 5.x to 7.3 | 'all versions from 5 onwards' (NCSC-NL); 'all PHP versions >= 5.4' (Wiz); 'toutes versions 5.x, 6.x, 7.x' (CERT-FR) | no release, no backport | no |
The CVE records carry defaultStatus 'unaffected' and list only 8.2 to 8.5, so an automated scanner reading the CVE will call 7.4 to 8.1 unaffected. The php.net advisory, the backport branches and a Greenbone reply on oss-security say otherwise. CVE record php.net php-src NCSC-NL Wiz on X CERT-FR oss-security
Deployments
| SAPI | Risk | What the primary sources say | Sources |
|---|---|---|---|
| Apache mod_php | highest | Unauthenticated RCE demonstrated over HTTP with default input and memory limits, before any application code runs. | php.net PHP oss-security |
| PHP-FPM | susceptible | For CVE-2026-109618 the GitHub advisory says no complete FPM exploit has been demonstrated; the PHP Foundation blog says RCE was confirmed on FPM through application-level paths. For CVE-2026-109619 the session path was validated against FPM. | PHP PHP Foundation PHP oss-security |
| php-cgi | at risk | Listed by php.net among installations serving web requests. | php.net |
| FrankenPHP | likely susceptible | 'likely susceptible' per the GitHub advisory. | PHP |
| LiteSpeed (LSAPI) | likely, unvalidated | 'application-specific exploits being likely but unvalidated'. | PHP |
| CLI, cron, queue workers | not web-serving | The advisory scopes the risk to installations serving web requests. A CLI process that parses untrusted input is not covered either way by the primary sources. | php.net |
Applications
Calif reports confirmed pre-authentication RCE against WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS; Wiz confirmed Drupal (20 August) and WordPress (21 August). The flaw is below the application, so any PHP web application on an affected runtime is in scope. Calif Wiz
The NCSC-NL inventory, counted
| Status | CVE-2026-109618 | CVE-2026-109619 |
|---|---|---|
| Vulnerable | 206 | 206 |
| Fix | 46 | 46 |
| Investigation | 418 | 418 |
| Not vuln | 3 | 3 |
| none | 1 | 1 |
NCSC-NL generates the list from an SPDX 3 inventory with VEX statements and says an entry is an investigation lead until a vendor or upstream backs it. 46 products carry a fix for both CVEs; 206 are marked vulnerable to at least one. The suppliers with the most entries:
| Supplier | Entries |
|---|---|
| The PHP Group | 86 |
| Nette community | 15 |
| Synology | 11 |
| Canonical / Ubuntu package maintainers | 9 |
| Sean Morris / php-wasm project | 7 |
| Icinga GmbH | 6 |
| Symfony | 6 |
| Microsoft Azure Storage | 5 |
| Plesk | 5 |
| SURF | 5 |
| TuxCare / CloudLinux | 5 |
| WordPress Playground contributors | 5 |
| Docker Official Images / docker-library PHP maintainers | 4 |
| 4 | |
| Laravel | 4 |
The full inventory, all 674 rows → The parsed file is in the vault as software-list-cca173c64ec5.json; the repository bundle and tree at the same commit are there too. NCSC-NL NCSC-NL