Sucuri has deployed additional Web Application Firewall (WAF) rules to help mitigate attack patterns associated with the recently disclosed critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. We are monitoring these protections and related traffic.
These rules provide an additional layer of protection for traffic passing through the Sucuri Website Firewall. WAF protection does not replace patching PHP on your origin server.
We strongly recommend contacting your hosting provider or server administrator to apply the appropriate PHP security update as soon as possible. The PHP Development Team has released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Your operating system or hosting vendor may also provide patched packages.
Please review the official PHP security advisory for remediation guidance.
This incident affects: Sucuri Website Firewall (North America West, North America Central, North America East, North America South East, Europe West, Europe Central, Asia East, South America, Australia, DDoS Mitigation Platforms, DNS Infrastructure).