Critical Security Vulnerabilities in PHP
AI Analysis
On 21 October 2026, the CSSF warned supervised entities about CVE-2026-109618 and CVE-2026-109619, critical PHP runtime vulnerabilities capable of unauthenticated remote code execution. The CSSF expects firms to treat all PHP-powered services as potentially exposed pending confirmation of affected versions and reminds them that successful unauthorised access may constitute a major ICT-related incident requiring notification.
Key dates
- 2026-10-21
- CSSF published the communiqué warning about CVE-2026-109618 and CVE-2026-109619; PHP also released security updates addressing the vulnerabilities on this date.
Suggested considerations
- Firms should consider urgently inventorying internet-facing and internally accessible services that run PHP, including PHP embedded in outsourced, cloud-hosted and vendor-managed applications.
- Technology and security teams may wish to determine the installed PHP branch and apply the relevant fixed release, including PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 where applicable, after validating compatibility and deployment integrity.
- Where immediate patching is not feasible, firms should consider isolating or taking affected internet-facing services offline, placing them behind network-layer authentication or equivalent compensating controls, and restricting PHP execution to required functions.
- Security teams may wish to review web-server, PHP, application, endpoint and identity logs for exploitation indicators, unusual child processes, unexpected outbound connections, persistence and activity associated with unauthenticated requests.
- Firms should consider assessing whether any unauthorised remote code execution, suspected compromise or material service disruption meets the applicable major ICT-related incident criteria and documenting the classification decision.
- DORA entities should consider preparing the notification required under Circular CSSF 25/893 and the applicable DORA implementing rules if the incident is classified as major; the initial notification is generally due within four hours of classification and no later than 24 hours after awareness, followed by an intermediate report within 72 hours and a final report within one month.
- Entities subject to CSSF Circular 24/847 should consider following that circular's notification process for a major ICT-related incident and confirming whether any parallel obligations arise under applicable NIS or sectoral requirements.
- Compliance teams may wish to retain evidence of the affected-asset inventory, patch or mitigation decisions, threat monitoring, incident assessment and communications with relevant ICT third-party providers.
What changed
The publication does not introduce a new standalone rule or compliance deadline; it provides an urgent supervisory warning and links the risk to existing ICT incident-reporting obligations. Until the affected versions were officially confirmed, the CSSF's stated position was that all PHP-powered services should be treated as potentially exposed. Independent security analysis reported that PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with both vulnerabilities rated CVSS 4.0 at 9.2 and capable of execution under the web-worker account. For DORA entities and relevant payment service providers, Circular CSSF 25/893 applies; other entities within the CSSF's ICT incident-reporting framework may remain subject to Circular CSSF 24/847.
Compliance impact
The CSSF characterises unauthenticated remote code execution as unauthorised malicious access and states that it constitutes a major ICT-related incident requiring notification under Circular CSSF 25/893 or CSSF Circular 24/847, depending on the entity. The principal consequences are accelerated vulnerability-management, incident-classification and regulatory-reporting expectations, with potential
Who is affected
Related regulations
References
AI-generated analysis. May contain errors or omissions — verify with the original CSSF source before acting. Full disclaimer.
What the CSSF said
No description available.
Published by CSSF . Read the full notice at the source for the authoritative text.