Critical Security Vulnerabilities in PHP

The CSSF has been made aware of two critical security vulnerabilities in PHP runtime (CVE-2026-109618 and CVE-2026-109619). Both can lead to unauthenticated remote code execution (RCE).

The exact affected versions have, at the time of this communication, not yet been confirmed. Until officially confirmed, financial entities should treat all PHP-powered services as potentially exposed.

CIRCL, the Computer Incident Center Luxembourg, published a report on this subject, including recommendations, available at this URL: https://www.circl.lu/pub/tr-102/.

The CSSF strongly recommends all supervised entities concerned to duly take note of this report and to take appropriate actions.

In addition, as the unauthenticated remote code execution consists of an unauthorised malicious access, the CSSF reminds all supervised entities that this constitutes a major ICT-related incident that needs to be notified, according to either Circular CSSF 25/893 (DORA) or CSSF 24/847, depending on the type of entity.