Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai
Reference: October 21, 2026by Akamai Security Intelligence Group
On October 21, 2026, PHP released a security advisory remedying two severe security flaws, each carrying a CVSS v4.0 rating of 9.2.
The patches are available immediately and users are urged to upgrade to fixed releases as soon as possible.
Mitigation with Akamai App & API Protector
Akamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts.
Adaptive Security Engine: 3000991 v1 — PHP Remote Code Execution Attack Detected (CVE-2026-109618, CVE-2026-109619)
Based on our investigation, Akamai App & API Protector is mitigating weaponized payloads with existing command injection rules.
The most effective defense continues to be the prompt application of vendor patches. For organizations that cannot patch immediately, applying web application firewall rules is critical to block attack attempts.
Stay tuned
The Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.
