Hello from Sparrow Cloud.

Two security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have recently been disclosed in PHP, a programming language widely used to build websites.

These vulnerabilities may pose serious security risks to PHP-based servers and application environments. Users are advised to promptly check for affected versions and apply the relevant security updates.

Overview

CVE IDs: CVE-2026-109618 and CVE-2026-109619
Primary risks: Successful exploitation may allow an unauthenticated attacker to execute code remotely (RCE) and disclose sensitive information.
Severity: Critical (CVSS v4.0 score: 9.2 for both vulnerabilities)

Affected and fixed versions are the same for both vulnerabilities.

Note: PHP 8.1 and earlier have reached the end of official security support. Users are advised to upgrade to a supported version.
Reference: KISA – PHP Product Security Update Advisory.

Recommended Actions

Check your environment
Confirm whether PHP is installed, identify the versions in use, and determine whether any affected versions are deployed.

Apply security updates (see the table above)
For PHP 8.2, 8.3, 8.4, and 8.5, apply the security update for the corresponding version branch.
For PHP 8.1 and earlier, upgrade to a supported version

Identifying Vulnerable Components in Sparrow Cloud

Sparrow Open Source (SCA) supports automated detection of these vulnerabilities and helps you identify affected components.

These vulnerabilities may allow an unauthenticated remote attacker to execute arbitrary code on affected servers. Prompt assessment and patching are essential.

Sparrow Cloud is committed to helping you minimize the risk posed by these vulnerabilities and maintain secure, stable service operations.

If you have any questions, please contact our Customer Support team.
Technical Support / Service Issues: +82-2-6263-7400