---
type: "post"
id: "critical-vulnerabilities-in-php-cert-eu-security-advisory-7570e7"
slug: "critical-vulnerabilities-in-php-cert-eu-security-advisory-7570e7"
title: "Critical Vulnerabilities in PHP (CERT-EU Security Advisory 2026-018)"
description: "CERT-EU updated Security Advisory 2026-018 on 23 October 2026 to add CVE-2026-115560, a PHP vulnerability that could lead to remote code execution."
retrieval_nugget: "CERT-EU updated Security Advisory 2026-018 on 23 October 2026 to add CVE-2026-115560, a PHP vulnerability that could lead to remote code execution."
published_at: "2026-10-23"
updated_at: "2026-10-23"
record_date: "2026-10-23"
date_kind: "published_at"
topics: ["security"]
entities: ["CERT-EU","PHP","PHP-FPM","FrankenPHP","LiteSpeed"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "CERT-EU adds a third PHP RCE vulnerability disclosed on Oct. 23, affecting unusually configured web applications, with no out-of-band patch planned and mitigation advised."
prior_refs: ["memory:bca7b16c-c977-8e82-aa57-a9740082e6be","memory:b96fa1d6-a199-8ee5-a6d1-acf05be2ce9c","memory:fc5b3c55-ed3f-8ef0-a741-d4d1b0775dfa","memory:592c9dc4-991d-8a8c-ae31-be347a0f42d2"]
source_url: "https://cert.europa.eu/publications/security-advisories/2026-018"
source_urls: ["https://cert.europa.eu/publications/security-advisories/2026-018"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:critical-vulnerabilities-in-php-cert-eu-security-advisory-7570e7"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/critical-vulnerabilities-in-php-cert-eu-security-advisory-7570e7/","markdown":"https://newruntime.com/posts/critical-vulnerabilities-in-php-cert-eu-security-advisory-7570e7.md","json":"https://newruntime.com/posts/critical-vulnerabilities-in-php-cert-eu-security-advisory-7570e7.json"}
---

# Critical Vulnerabilities in PHP (CERT-EU Security Advisory 2026-018)

## Retrieval answer

CERT-EU updated Security Advisory 2026-018 on 23 October 2026 to add CVE-2026-115560, a PHP vulnerability that could lead to remote code execution.

CERT-EU updated Security Advisory 2026-018 on 23 October 2026 to add CVE-2026-115560, a PHP vulnerability that could lead to remote code execution. Technical details have not been published. The advisory says PHP will provide a full advisory with its next regular release; meanwhile it recommends setting `session.upload_progress.enabled=0` and restarting workers.

The advisory also covers CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. CERT-EU says both can permit unauthenticated remote code execution and that initial proofs of concept are circulating. PHP released fixes on 21 October in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Affected web-serving configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

CERT-EU recommends patching affected installations immediately. Where that cannot be done, it advises isolating internet-facing applications until fixes are applied and verified. It notes minimal source backports for PHP 7.4, 8.0, and 8.1, while older branches are otherwise end of life.

The source does not confirm active exploitation, disclose technical details for CVE-2026-115560, or identify every third-party product that embeds an affected PHP runtime.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)