Source · advisory · primary · captured

UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP

NCSC New Zealand · https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/ · published 2026-10-22T09:15+13:00 (=2026-10-21T20:15Z); updated 10:20am 22-10-26 NZDT (=21:20Z) · added by collector-gov · slug ncsc-nz-alert-php

TLP:CLEAR. 'The NCSC is aware of reports of active exploitation.' The only agency so far to say this. Advice: update to fixed versions 'as soon as possible'; investigate compromise. No offline advice.

Reports of active exploitation exist2026-10-21 20:15 UTC: NCSC New Zealand: 'aware of reports …NCSC New Zealand

What it says, as the collector read it

NCSC NZ alert

  • "9:15AM, 22 October 2026" (NZDT, UTC+13, so 2026-10-21T20:15Z; our conversion). "(Updated 10:20am, 22-10-26)" = 21:20Z. TLP Clear. Captured 2026-10-22T08:17:00Z.
  • "The NCSC is aware of reports of active exploitation." Every other agency says no exploitation has been seen (CISA, CCCS, ACSC in Australia, CERT.LV "no successful"). NZ does not say whose reports. Flag this as a discrepancy.
  • Advice: "Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35." / "apply the remediation as soon as possible" / "investigate unauthorised access or compromise". The update notes that firewalls, edge devices and embedded platforms need separate vendor remediation. No offline advice.

Claims that cite it

ClaimWho says itStatusPrimarySources
Reports of active exploitation exist
The only agency saying so, and it does not say whose reports.
NCSC New Zealandreported1/1NCSC New Zealand

Events that cite it

WhenEventTime is
2026-10-21 20:15 UTCNCSC New Zealand: 'aware of reports of active exploitation' (09:15 NZDT 22 October; updated 21:20Z).stated

Agency rows from this source

Exploitation signals from this source

The bytes

capture 20261022T081700Z · HTTP 200 · https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/
  • headers.json 5e5b7ef0258116f0d6925dab7f8189e2223e414a58521729043ca4f399ceabcc 1,992 bytes
  • page.html 9f3205c8338c598bedc1fa1f1b0726243fd7cce324d6d0a797a7c55fbd277915 49,604 bytes
  • provenance.json 7536377248a3645980d9a70e1d2e6c3bb2f1c0e799ff9ccd12b4320bd1724b01 1,049 bytes
  • rendered.html 32cdd5364dd2c631a73c0c834763cf3cb9b776145d2ebf5e4f3376e25e89758e 41,928 bytes
  • screenshot.png 4dd2cb007efcf0696650ebca1087f184c6ed83297bc6f80dd678d9f6954146ac 528,343 bytes
  • text.txt 992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301 3,799 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →