# Source: UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP

NCSC New Zealand: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · advisory · primary · captured

# UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP

**NCSC New Zealand** · [https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/](https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/) · published 2026-10-22T09:15+13:00 (=2026-10-21T20:15Z); updated 10:20am 22-10-26 NZDT (=21:20Z) · added by `collector-gov` · slug `ncsc-nz-alert-php`

TLP:CLEAR. 'The NCSC is aware of reports of active exploitation.' The only agency so far to say this. Advice: update to fixed versions 'as soon as possible'; investigate compromise. No offline advice.

## What it says, as the collector read it

#### NCSC NZ alert

- "9:15AM, 22 October 2026" (NZDT, UTC+13, so 2026-10-21T20:15Z; our conversion). "(Updated 10:20am, 22-10-26)" = 21:20Z. TLP Clear. Captured 2026-10-22T08:17:00Z.

- **"The NCSC is aware of reports of active exploitation."** Every other agency says no exploitation has been seen (CISA, CCCS, ACSC in Australia, CERT.LV "no successful"). NZ does not say whose reports. Flag this as a discrepancy.

- Advice: "Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35." / "apply the remediation as soon as possible" / "investigate unauthorised access or compromise". The update notes that firewalls, edge devices and embedded platforms need separate vendor remediation. No offline advice.

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Reports of active exploitation existThe only agency saying so, and it does not say whose reports. | NCSC New Zealand | reported | 1/1 | [NCSC New Zealand](../../sources/ncsc-nz-alert-php/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-21 20:15 UTC | NCSC New Zealand: 'aware of reports of active exploitation' (09:15 NZDT 22 October; updated 21:20Z). | stated |

### Agency rows from this source
- [NCSC](../../agencies/index.html): offline none

### Exploitation signals from this source
- [2026-10-21 20:15 UTC](../../exploitation/index.html): 'The NCSC is aware of reports of active exploitation.' Whose reports is not said.

## The bytes
capture 20261022T081700Z · HTTP 200 · https://www.ncsc.govt.nz/alerts/cve-2026-109618-and-cve-2026-109619-affecting-php/- `headers.json` 5e5b7ef0258116f0d6925dab7f8189e2223e414a58521729043ca4f399ceabcc 1,992 bytes
- `page.html` 9f3205c8338c598bedc1fa1f1b0726243fd7cce324d6d0a797a7c55fbd277915 49,604 bytes
- `provenance.json` 7536377248a3645980d9a70e1d2e6c3bb2f1c0e799ff9ccd12b4320bd1724b01 1,049 bytes
- `rendered.html` 32cdd5364dd2c631a73c0c834763cf3cb9b776145d2ebf5e4f3376e25e89758e 41,928 bytes
- `screenshot.png` 4dd2cb007efcf0696650ebca1087f184c6ed83297bc6f80dd678d9f6954146ac 528,343 bytes
- `text.txt` 992fc3b6639069a9eb6618d9f6a71e994633960f0d6d4c77bd74bc797caa5301 3,799 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/ncsc-nz-alert-php/index.html