{"id":4356,"date":"2026-10-22T10:56:28","date_gmt":"2026-10-22T01:56:28","guid":{"rendered":"https:\/\/sparrow.im\/en\/?post_type=news&p=4356"},"modified":"2026-10-22T10:56:28","modified_gmt":"2026-10-22T01:56:28","slug":"php-security-vulnerability-notice-cve-2026-109618-cve-2026-109619","status":"publish","type":"news","link":"https:\/\/sparrow.im\/en\/news\/php-security-vulnerability-notice-cve-2026-109618-cve-2026-109619\/","title":{"rendered":"PHP Security Vulnerability Notice (CVE-2026-109618, CVE-2026-109619)"},"content":{"rendered":"

Hello, this is Sparrow.<\/p>\n

Security vulnerabilities (CVE-2026-109618, CVE-2026-109619) have recently been disclosed in PHP, a programming language widely used for website development.
\nThese vulnerabilities may pose a serious security threat to PHP-based server and application environments, so we recommend promptly checking affected versions and applying security updates.<\/p>\n

\u25a0 Overview<\/h3>\n

\u2013 CVE ID:<\/strong> CVE-2026-109618, CVE-2026-109619
\n\u2013 Key Risk:<\/strong> If exploited, these vulnerabilities may allow an unauthenticated attacker to perform remote code execution (RCE) and leak sensitive information
\n\u2013 Severity:<\/strong> Critical (CVSS v4.0 9.2, same for both vulnerabilities)
\n\u2013 Affected Scope and Fixed Versions <\/strong>(same for both vulnerabilities)<\/p>\n

\n\n\n\n\n\n\n\n\n
Product Name<\/th>\nAffected Versions<\/th>\nFixed Version<\/th>\n<\/tr>\n<\/thead>\n
PHP 8.2<\/td>\n8.2.35 Below<\/td>\n8.2.35 or Later<\/td>\n<\/tr>\n
PHP 8.3<\/td>\n8.3.36 Below<\/td>\n8.3.36 or Later<\/td>\n<\/tr>\n
PHP 8.4<\/td>\n8.4.27 Below<\/td>\n8.4.27 or Later<\/td>\n<\/tr>\n
PHP 8.5<\/td>\n8.5.12 Below<\/td>\n8.5.12 or Later<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u203b PHP 8.1 and earlier versions have reached end of official security support, so we recommend upgrading to a currently supported version. (* Reference: KISA \u2013 PHP Product Security Update Advisory<\/a>)<\/p>\n

\u25a0 Recommended Actions<\/h3>\n

\u2013 Check Your Operating Environment<\/strong>
\n: Verify whether PHP is installed, confirm the version in use, and check whether a vulnerable version is being used<\/p>\n

\u2013 Apply Security Patches (*see table above)<\/strong>
\n: For PHP 8.2, 8.3, 8.4, and 8.5, apply the security update corresponding to each version
\n: For PHP 8.1 and earlier, upgrade to a currently supported version<\/p>\n

These vulnerabilities allow an external attacker to execute arbitrary commands on the server without any complex preconditions, so prompt environment checks and patch application are essential.<\/p>\n

Sparrow SCA, our open source analysis and management tool, automatically detects the PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) for which immediate security updates have been recommended.
\n<\/strong>
\nSparrow is committed to actively supporting you in minimizing any impact from these vulnerabilities and maintaining stable service operations.<\/p>\n

If you have any questions, please feel free to contact our Customer Support Center at any time.<\/p>\n

(Contact) Technical Support \/ Incidents: +82-2-6263-7411<\/p>\n","protected":false},"featured_media":0,"template":"","class_list":["post-4356","news","type-news","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/sparrow.im\/en\/wp-json\/wp\/v2\/news\/4356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sparrow.im\/en\/wp-json\/wp\/v2\/news"}],"about":[{"href":"https:\/\/sparrow.im\/en\/wp-json\/wp\/v2\/types\/news"}],"wp:attachment":[{"href":"https:\/\/sparrow.im\/en\/wp-json\/wp\/v2\/media?parent=4356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}