Hello, this is Sparrow.
Security vulnerabilities (CVE-2026-109618, CVE-2026-109619) have recently been disclosed in PHP, a programming language widely used for website development.
These vulnerabilities may pose a serious security threat to PHP-based server and application environments, so we recommend promptly checking affected versions and applying security updates.
■ Overview
– CVE ID: CVE-2026-109618, CVE-2026-109619
– Key Risk: If exploited, these vulnerabilities may allow an unauthenticated attacker to perform remote code execution (RCE) and leak sensitive information
– Severity: Critical (CVSS v4.0 9.2, same for both vulnerabilities)
– Affected Scope and Fixed Versions (same for both vulnerabilities)
| Product Name | Affected Versions | Fixed Version |
|---|---|---|
| PHP 8.2 | 8.2.35 Below | 8.2.35 or Later |
| PHP 8.3 | 8.3.36 Below | 8.3.36 or Later |
| PHP 8.4 | 8.4.27 Below | 8.4.27 or Later |
| PHP 8.5 | 8.5.12 Below | 8.5.12 or Later |
※ PHP 8.1 and earlier versions have reached end of official security support, so we recommend upgrading to a currently supported version. (* Reference: KISA – PHP Product Security Update Advisory)
■ Recommended Actions
– Check Your Operating Environment
: Verify whether PHP is installed, confirm the version in use, and check whether a vulnerable version is being used
– Apply Security Patches (*see table above)
: For PHP 8.2, 8.3, 8.4, and 8.5, apply the security update corresponding to each version
: For PHP 8.1 and earlier, upgrade to a currently supported version
These vulnerabilities allow an external attacker to execute arbitrary commands on the server without any complex preconditions, so prompt environment checks and patch application are essential.
Sparrow SCA, our open source analysis and management tool, automatically detects the PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) for which immediate security updates have been recommended.
Sparrow is committed to actively supporting you in minimizing any impact from these vulnerabilities and maintaining stable service operations.
If you have any questions, please feel free to contact our Customer Support Center at any time.
(Contact) Technical Support / Incidents: +82-2-6263-7411