I wanted to make the OpenEMR community aware of two critical PHP vulnerabilities disclosed today, October 20, 2026.
The PHP security team has announced an emergency security release scheduled for October 21 at 14:00 UTC (9:00 AM Central).
The vulnerabilities are identified as:
CVE-2026-109618
CVE-2026-109619
Both have been assigned a CVSS v4.0 severity score of 9.2 (Critical).
Security researchers are reporting that these vulnerabilities may allow remote code execution (RCE), potentially permitting attackers to execute malicious code on affected servers.
PHP has not yet published the complete technical details, affected versions, or fixed versions. However, preliminary reports suggest that multiple PHP generations may be affected.
Why this matters to OpenEMR
Because OpenEMR runs on PHP, administrators should pay close attention to this disclosure, especially those operating internet-facing installations containing sensitive patient information.
This is a vulnerability in PHP itself, not a confirmed vulnerability in OpenEMR’s application code.
Recommended precautions
Identify the PHP versions running on your OpenEMR servers.
Prepare to deploy the security updates as soon as they become available.
If using Docker, verify that your container images include the updated PHP packages. Simply restarting an existing container will not necessarily apply the fix.
Review firewall and network exposure, particularly for publicly accessible installations.
If using Cloudflare or another WAF, ensure security protections are enabled, but don’t assume a reverse proxy alone will prevent exploitation.
For managed hosting, contact your provider to confirm their emergency patching plans.
Sources:
Official PHP announcement: PHP: News Archive - 2026
BleepingComputer: PHP warns admins of two critical flaws, emergency patches coming tomorrow