Critical PHP Vulnerabilities Prompt Urgent Cyber Security Warning

Published on 21 October 2026 and updated on 22 October, the alert confirms that security patches have now been released to address the vulnerabilities, identified in media reporting as CVE-2026-109618 and CVE-2026-109619.

The ACSC initially advised that PHP versions from PHP 5 onwards may be affected, potentially exposing a broad range of websites, applications and organisational systems to cyber security risks. At the time of the initial alert, the ACSC was not aware of successful active exploitation in Australia.

Organisations are being urged to take immediate precautions by identifying PHP installations within their environments, reviewing official PHP security guidance, applying available security updates and monitoring systems for suspicious activity.

For records and information management professionals, the alert reinforces the importance of understanding the technologies supporting organisational information systems. Vulnerabilities in web applications can place sensitive records, personal information and business-critical data at risk, highlighting the need for collaboration between R&IM, IT and cyber security teams.

Organisations should ensure appropriate security controls, software updates and information governance practices are in place to protect their digital information assets.

Read the full ASD's ACSC Critical PHP Vulnerabilities Alert for the latest advice and mitigation guidance.