A 12-month-old PHP flaw pair that lets attackers run code on unpatched web servers is now a patch-clock problem for every hospital running appointment portals, patient forms, and legacy intranet apps, and federal and EU agencies are pressing for immediate upgrades.
The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, both carry CVSS 4.0 scores of 9.2 and allow unauthenticated remote code execution across PHP 5.4 through 8.5. The security team published fixes on October 21 in 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and shipped backports for end-of-life branches 7.4 to 8.1.
Exploitation came before the patch. Amazon Threat Intelligence recorded an attempt on October 17, four days ahead of disclosure, and researchers report broad scanning since.
CISA and the EU Commission, ENISA, CERT-EU, and Europol urged organizations to act at once. The National Security Agency told defenders to take systems offline if an update could not be applied immediately – unusable advice for a hospital scheduling platform or a public health dashboard.
The American Hospital Association issued its own advisory on October 21 and told members no PHP installation serving web requests is exempt.
Healthcare is unusually exposed because so much clinical software still ships on PHP: patient portals, e-prescribing front ends, lab result viewers, and the WordPress sites most hospitals use for public communication. The industry-specific risk is that these apps sit on the public internet and are frequently maintained by small vendors or single contractors.
Practical sequence for security teams: inventory internet-facing PHP services, confirm version numbers down to the patch release, patch externally exposed systems first, and treat unpatched appliances as compromised until logs prove otherwise. Check web shells in upload directories afterward – RCE flaws of this severity are rarely used only once.
