# PHP Vulnerability Rated 9.2, Highest Severity

> EU urges shutdown of unpatched PHP sites after critical vulnerability rated 9.2.
- Title: PHP Vulnerability Rated 9.2, Highest Severity · BigGo Finance
- Summary: EU urges shutdown of unpatched PHP sites after critical vulnerability rated 9.2. EU authorities recommend shutting down unpatched PHP sites after two…
- Keywords: php, php vulnerability, cvss v4.0, php 5, php 8.2, php 8.3, php 8.4, php 8.5, php 8.1, php 5 and later, remote code execution, cve-2026-109618
- Source: BigGo Finance — https://finance.biggo.com/news/314e2cc6-2088-4681-bfc9-fbcd063bd3df
- Author: BigGo Finance
- Published: 2026-10-21T10:35:12+00:00
- Read time: 1 min
- Topics: php, php vulnerability, cvss v4.0, php 5, php 8.2, php 8.3, php 8.4, php 8.5, php 8.1, php 5 and later, remote code execution, cve-2026-109618
## PHP vulnerability critical
PHP development team announced fixes for two critical vulnerabilities rated 9.2 under CVSS v4.0 on Oct. 21.

> CVE-2026-109618
## Remote code execution risk
Flaws could allow attackers to execute code remotely without authentication, raising concerns about internet infrastructure.
## EU and Australian guidance
CERT-EU urged organizations unable to apply patches to consider shutting down affected sites or disconnecting from networks.
## Australian Cyber Security Centre
ACSC issued similar guidance urging identification of PHP systems and preparation for patches.
## Affected versions
PHP 5 and later may be affected but fixes only for supported branches 8.2 through 8.5.
## Emergency maintenance in Japan
Japanese services entered emergency maintenance or announced plans to do so from around 11 p.m. on Oct. 21.
## Patch release schedule
Fixes scheduled for release at 2 p.m. GMT on Oct. 21 (10 a.m. EDT on Oct. 21).
## Critical impact
Vulnerabilities could lead to data theft, website tampering, or full system takeover.
## Key takeaway

EU authorities recommend shutting down unpatched PHP sites after two critical vulnerabilities rated 9.2 under CVSS v4.0 could allow remote code execution without authentication.