PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Information

October 2026

What is PHP?

PHP is a programming language used to build websites. It runs on the web server and is behind a large number of websites, including many built with WordPress and other well-known website tools.

On 21 October 2026, the PHP project released updates to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (also known as "PHP2Shell"). If left unpatched, they could allow an attacker to run their own commands on a web server that is running PHP, without needing to log in. The UK's National Cyber Security Centre (NCSC) has urged organisations to update as soon as possible.

The vulnerabilities were found by security researchers using AI tools, and were reported to the PHP project ahead of the fixes being released. The PHP security advisory credits researchers from Calif, Wiz and OpenAI.

Is MIDAS affected?

In short - No - our MIDAS software and our cloud-hosted customer servers are not affected by these vulnerabilities.

The MIDAS booking software is written in Perl, not PHP. PHP is not installed on the servers that host our cloud customers (as it isn't needed), so there is nothing on those servers for these vulnerabilities to affect. If your MIDAS system is cloud-hosted by us, you don't need to do anything.

Our main website (mid.as) and this security website are also written in Perl. The only part of our public website that uses PHP is our blog at mid.as/blog, which runs on WordPress. We updated PHP on the server hosting it to version 8.5.12 (one of the fixed releases) at 14:37 UTC on 21 October 2026.

What about self-hosted MIDAS systems?

If you run a self-hosted edition of MIDAS (where our software is running on your own server and infrastructure), then the MIDAS software itself is not affected. It doesn't use or require PHP.

However, that doesn't necessarily mean your server isn't running PHP. If the same server also hosts other websites or applications (a staff intranet, a WordPress site or a wiki, for example), then it may well have PHP installed. The UK's National Cyber Security Centre advises that all versions of PHP are affected, so it's worth checking even if your PHP version is fairly recent.

If PHP is present on your server, you should update it to one of the fixed versions:

PHP 8.5.12 (or later)
PHP 8.4.27 (or later)
PHP 8.3.36 (or later)
PHP 8.2.35 (or later)

PHP 8.1 and older no longer receive updates from the PHP project. If you are running one of these, ask your server or software vendor whether they provide a fix, or upgrade to a version that is still supported.

Some Linux providers apply the fix to their own packages without changing the PHP version number, so if you're unsure whether you are up to date, please check with them.

If in doubt, ask your IT support team or hosting provider to check whether PHP is installed on your server and to update it if needed.

Where can I learn more about these vulnerabilities?

More information on these vulnerabilities may be found via the following links:

The PHP project's own security advisory, and the technical advisories for CVE-2026-109618 and CVE-2026-109619.
The UK's National Cyber Security Centre.
Wiz Research's write-up, which also describes how AI was used to find the vulnerabilities.