Akamai
Skip to main content
Akamai
Log in
Log in Close
Cloud Manager
Manage your cloud computing services
Log in Close
Control Center
Manage your security and delivery services
Background

Critical Remote Code Execution Vulnerabilities in PHP Core

October 21, 2026 by Akamai Security Intelligence Group

Share

On October 21, 2026, PHP released a security advisory remedying two severe security flaws, each carrying a CVSS v4.0 rating of 9.2.

The patches are available immediately and users are urged to upgrade to fixed releases as soon as possible. 

Mitigation with Akamai App & API Protector

Akamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts. 

  • Adaptive Security Engine: 3000991 v1 — PHP Remote Code Execution Attack Detected (CVE-2026-109618, CVE-2026-109619)

Based on our investigation, Akamai App & API Protector is mitigating weaponized payloads with existing command injection rules. 

The most effective defense continues to be the prompt application of vendor patches. For organizations that cannot patch immediately, applying web application firewall rules is critical to block attack attempts.

Stay tuned

The Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.

Read more research

About the author

Akamai Wave Blue

Akamai Security Intelligence Group

Akamai SIG is a global team of world-class researchers, engineers, strategists, and data scientists with a broad range of expertise and security disciplines. Our data sources include the enormous Akamai Cloud, open sources, collaboration with third parties, and dark web intelligence. We have also developed our own algorithms and tools that help us deliver our research and keep Akamai security solutions up to date.

View author profile

Tags

Threat Intelligence
CyberSecurity
Research
Security Research
App & API Protector

Related Blogs

Akamai App & API Protector customers are protected.
Akamai App & API Protector customers are protected.
Security Research

CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products

October 07, 2026Akamai Security Intelligence Group

Read about CVE-2026-21589, a critical arbitrary file read vulnerability affecting multiple Atlassian Data Center products. Akamai customers are protected.

Read more
ExAR helped the customer contain the incident before it developed into a broader operational security event.
ExAR helped the customer contain the incident before it developed into a broader operational security event.
Security Research

How Akamai’s ExAR Capabilities Contained a LATAM Supply Chain Attack

October 06, 2026Dennis Birchard and João Dejavite

Learn how Akamai’s ExAR capabilities helped contain a complex supply chain intrusion targeting Linux, OpenShift, and Windows DMZ workloads in Latin America.

Read more
These findings suggest an active ecosystem capable of supporting multiple monetization and attack strategies simultaneously.
These findings suggest an active ecosystem capable of supporting multiple monetization and attack strategies simultaneously.
Research

When Productivity Extensions Become Attack Platforms

September 30, 2026Natalie Zagarov

Our research uncovered a campaign of 32 malicious browser extensions that uses remote configs to spy on 9,800+ users and hijack browsing activity.

Read more