Notification about critical vulnerability CVE-2026-109618 and CVE-2026-109619 on PHP – action required on Virtual Machines.

Dear Cloud Users,  

This email is to notify you about the critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 about PHP, that can allow unauthenticated remote code execution. 

As reported on the PHP site, all PHP users are strongly encouraged to update immediately and mitigate the vulnerability.  

Additional information can be found here: 

[1] https://www.php.net/archive/2026.php#2026-10-21-5 
[2] https://www.cve.org/CVERecord?id=CVE-2026-109618 
[3] https://www.cve.org/CVERecord?id=CVE-2026-109619 

Let us know in case of issues, by sending an email to [email protected]  

Best regards,
HPC Cloud User Support @ CINECA