# Security advisory: Critical PHP vulnerabilities — what to do before…

Canonical: https://brew.new/templates/ox/security-advisory-critical-php-vulnerabilities-what-to-do-before

Brand: ox.security
Category: general

![Preview of Security advisory: Critical PHP vulnerabilities — what to do before…](https://cdn.brew.new/email-preview-a4b6f37925d1f605-tracking_r57hcbgfdb6334mnxgxgbf4xss8gq805-1792592499727.png)

## Email content

Hi there,

The PHP team is patching two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, today at 14:00 UTC (10:00 ET). Both are rated CVSS v4.0 9.2 and described by researchers as unauthenticated remote code execution. Affected versions haven't been confirmed yet.

What to do now:

Disable unused file uploads: set file_uploads = Off in php.ini if your apps don't accept uploads.

Avoid unofficial "exploits" or "scanners" for these CVEs; they're a common malware lure.

Get your PHP owners ready to patch as soon as the fix lands.

What to do next:

The OX research team will share a full breakdown once the patch is out

Follow along today as we post updates in real time, we’ll send additional email updates, too

For now, read our guidance here:

Read our guidance

Best,

The OX Security Team

LinkedIn

X

YouTube

Instagram

OX logo navy

OX Security, 488 Madison Ave., New York, New York 10022, USA

Unsubscribe

Manage preferences

[Open and remix this design](https://brew.new/templates/ox/security-advisory-critical-php-vulnerabilities-what-to-do-before)

[Browse email designs](https://brew.new/browse/templates)