Important information: PHP vulnerability

You may have seen some of the recent attention around vulnerabilities affecting PHP. We’re sharing the information below as a helpful resource that you can use, where relevant, in conversations with Hiscox clients.

Our cyber incident response partner, Control Risks, has highlighted two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), which may allow unauthenticated remote code execution against vulnerable PHP systems. Security updates are available and affected organisations are strongly encouraged to update immediately.

Customers using PHP should:

  • Identify affected systems. Check internet-facing and internally accessible applications and services running PHP, including the PHP version and deployment model being used.
  • Prioritise internet-facing systems. Externally accessible systems should be addressed first, with particular priority given to Apache mod_php deployments.
  • Apply the latest security update. Control Risks advises upgrading, as applicable, to:
    • PHP 8.5.12
    • PHP 8.4.27
    • PHP 8.3.36
    • PHP 8.2.35
  • Restart affected services after updating so that the patched software is loaded.
  • Verify the update. Confirm the PHP version actually running across affected hosts, containers and applications.
  • Address unsupported PHP versions. PHP 8.1 and older are no longer supported by the PHP project. Where an appropriate supported vendor backport is unavailable, Control Risks recommends migrating to a supported PHP branch.

Customers should note that patching prevents future exploitation of these vulnerabilities but does not determine whether compromise occurred before the update was applied.

Detailed information on the vulnerabilities, affected PHP versions and recommended remediation and monitoring actions from Control Risks can be found here Control Risks PHP vulnerability advisory. We encourage customers to share this guidance with their IT, information security, infrastructure or application teams and take the appropriate action as soon as possible.

If a Hiscox insured believes they may have suffered a cyber incident, they should follow the incident-notification process set out in their policy documentation.

Customers may also wish to visit the UK National Cyber Security Centre (NCSC) website for the latest information and guidance relating to these PHP vulnerabilities Critical security issue affecting PHP.