PHP Group flaws being used in attacks
PHP Group flaws being used in attacks are the three vulnerabilities in PHP Group’s products that the US Cybersecurity and Infrastructure Security Agency (CISA) lists in its Known Exploited Vulnerabilities catalog: flaws it has reliable evidence attackers are using.[1] All three are in PHP, and one of the three has been used by ransomware gangs. CISA added two in the last year, most recently on 26 Oct 2026.
Every one let an attacker take the product over, running their own code or taking full control. All are in software or equipment businesses use, rather than anything households have.
History
In 2024, CISA added one. It has since been used by ransomware gangs.
In 2026, CISA added two.[1]
The most recent, added on 26 Oct 2026, is CVE-2026-109619, a stale internal request-state flaw. Attackers can run their own code on PHP from anywhere, without logging in.
What attackers can do
Every one let an attacker take the product over, running their own code or taking full control: CVE-2026-109619, CVE-2026-109618 and CVE-2024-4577.[2]
Ransomware
One of PHP Group’s three listed flaws has been used in ransomware attacks, where gangs lock up a company’s files and demand money to unlock them.[1] Across CISA’s whole catalog the figure is about one in five.
It is CVE-2024-4577 (PHP-CGI OS command injection).
Who is affected
Probably not at home. PHP is used by businesses, not households. If you run a business, or work from home on company equipment, ask whoever looks after your IT to check.
Protection
- Update every PHP Group product you use.Install the updates PHP Group offers, on every device, and restart when asked. CISA lists a flaw only once there’s a fix or clear advice.
- If someone looks after IT for you, send them this page.Ask them to confirm each flaw below is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
List of flaws
Every PHP Group flaw on CISA’s list, newest first, in plain English,[3] each with a page of its own. marks the ones used in ransomware.
2026
| CVE | Flaw | Added |
|---|---|---|
CVE-2026-109619 |
Stale internal request-state. Attackers can run their own code on PHP from anywhere, without logging in. | |
CVE-2026-109618 |
Memory corruption. Attackers can run their own code on PHP from anywhere, without logging in. |
2024
| CVE | Flaw | Added |
|---|---|---|
CVE-2024-4577† Used in ransomware |
PHP-CGI OS command injection. Attackers can run their own code on PHP. |
See also
- Companies with a similar record: Veeam, GIGABYTE, Nagios, Accellion, BerriAI, TrueConf, Laravel and SmarterTools
- Companies, every company with three or more exploited flaws
- Exploited flaws, the newest from every company
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026.
- ^ National Institute of Standards and Technology. “National Vulnerability Database”, each flaw’s record, as of 1 Nov 2026.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
External links
- PHP Group in CISA’s Known Exploited Vulnerabilities catalog
- PHP Group in HARD’s lookup, with CISA’s full entries
This page was last updated on 30 Oct 2026, from version 2026.10.30 of CISA’s catalog.