CVE-2026-109618 explained: what the Php flaw means for your business and how to fix it

The two-minute check

1. Ask whoever built or hosts your website or web application whether it runs on Php.
2. Check your hosting control panel or server settings for a line that names Php and a version number.
3. If you use a Siemens Ruggedcom APE1808 device, check the label or management screen for that model name.
4. If you run PAN-OS on a firewall, or manage a Panorama M-200, M-300, M-500 or M-600 appliance, check its version screen.

When you can stop reading

The official record names only Php, the Siemens Ruggedcom APE1808 firmware and device, PAN-OS, and the Panorama M-200, M-300, M-500 and M-600 appliances. If none of those run anywhere in your business, this bug does not apply to you. You can close this tab.

What the official record says

The score is 9.8 out of 10, rated CRITICAL, in the National Vulnerability Database (NVD). The Common Vulnerability Scoring System (CVSS) vector for this flaw shows anyone with network access can reach it. No password or login is required. No one has to click a link or open a file. An attacker who succeeds can achieve remote code execution (RCE), meaning they can run their own commands on the computer, phone or server you run Php on.

The Exploit Prediction Scoring System (EPSS) puts the probability of exploitation in the next 30 days at 0.99999 (essentially 100%), with a percentile of 0.99998 (FIRST.org). EPSS is a forecast of likely exploitation activity, not a measure of how severe the flaw itself is.

The same update that fixes CVE-2026-109618 also fixes a related flaw, CVE-2026-109619. The record doesn't say that second flaw is on the Known Exploited Vulnerabilities (KEV) catalog, only that one update covers both.

What that means for a business like yours

In practice, an attacker on the internet can run their own code on a server with an unpatched copy of Php. They don't need a password. They don't need you to click anything. For a business running a website, a web application, or a Php-based system, that is about as serious as a flaw gets.

If someone else manages your IT

If LayerLogix or another provider manages your Php servers, ask them directly. You can send an email like this one.

"Please confirm our Php installation is patched against CVE-2026-109618 and CVE-2026-109619. Please confirm any Siemens Ruggedcom APE1808, PAN-OS, or Panorama appliance we run is also checked. Please tell us when this is done."

If you don't already have a provider handling this, our managed IT services team can take it off your plate.

If you manage it yourself

1. Open the Php security advisory for this flaw (GHSA-w8hw-w9fx-j79w).
2. Open the companion advisory for the sibling flaw (GHSA-6wmf-4rv5-p3rp).
3. Find the fixed release listed for your Php branch in the advisory.
4. Download and apply that update from your usual Php source.
5. Restart the web server or Php process so the new code loads.
6. If you run a Siemens Ruggedcom APE1808 device, check the Siemens advisory for the fixed firmware.
7. If you run PAN-OS or a Panorama appliance, check the vendor's advisory for the current version. The record doesn't list a specific advisory link for this product, so contact support directly.

CVE-2026-109618 is on the CISA Known Exploited Vulnerabilities (KEV) catalog (CISA KEV). That means criminals are already using it against real targets. It was added to the catalog on 2026-10-26, with a federal remediation due date of 2026-10-29 (CISA). Federal agencies must patch by that date. The same deadline is a reasonable target for your business too. The honest answer on timing is now.

After you update, confirm the version number actually changed. Check your Php version screen, or run your version-check command, and compare it to the fixed version named in the advisory. If you manage a Siemens Ruggedcom APE1808 device, confirm the firmware shown matches what the Siemens advisory lists as fixed. If you run PAN-OS or a Panorama appliance, confirm its version screen shows the update applied. Ask your IT provider to confirm in writing that the patch is live on every affected server, not just one.

If you cannot patch immediately, put a web application firewall or reverse proxy in front of the affected server. This can filter some malicious requests. It does not fix the underlying bug. Restrict which networks can reach your Php servers, ideally through managed security monitoring of trusted addresses. Limiting who can log into these servers, through privileged access management, reduces what an attacker can do even if they get in. Turn on logging and alerting so unusual activity gets noticed sooner. None of these steps replace the update. They only buy time until you can apply it.

Do I have to do anything if we only use Php on an internal tool, not a public website?

Yes. The vector for this flaw only requires network access, not a public-facing site. An internal tool reachable from your office network or a remote connection is still exposed.

Will installing this update break anything?

The record doesn't say. As with any update, test it on a non-production copy first if you can. Most Php version updates are routine, but custom code can sometimes need small adjustments.

What if we don't know whether our systems run Php?

Ask your web developer, hosting provider, or whoever built your site or application. If you want help figuring it out, our free IT assessment can identify what you're running.

Does this affect our compliance obligations?

If you store regulated data, such as health records or financial information, an unpatched critical flaw like this can put you out of step with requirements under HIPAA or the FTC Safeguards Rule. Patching promptly is part of meeting those obligations.

Is this connected to ransomware?

The record says there is no known ransomware use yet. It is still on the Known Exploited Vulnerabilities (KEV) catalog, which means it is already being used for other kinds of attacks. Waiting is not a safer option.

If you want help confirming your exposure or getting this patched correctly, contact LayerLogix or start with a free IT assessment. We provide 100% U.S.-based support with 20+ years of experience, business-hours support, and after-hours emergency response.