Clarification from IBM MQ regarding the recent critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
IBM MQ products are not affected by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 announced on 21 October 2026.
IBM MQ products do not include, bundle or use PHP. No update to IBM MQ software is required.
Third-party libraries
IBM is aware of a small number of existing open-source PHP wrappers for MQ client libraries.
While IBM does not provide, support, or maintain these interfaces, IBM strongly recommends that any users of third-party PHP wrappers for IBM MQ take immediate action to ensure their usage of these components is mitigated against these and other PHP vulnerabilities.
[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSYHRD","label":"IBM MQ"},"ARM Category":[{"code":"a8m0z00000008MzAAI","label":"Security"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.0.0;10.0.1;8.0.0;8.1.0;9.0.0;9.0.1;9.0.2;9.0.3;9.0.4;9.0.5;9.1.0;9.1.1;9.1.2;9.1.3;9.1.4;9.1.5;9.2.0;9.2.1;9.2.2;9.2.3;9.2.4;9.2.5;9.3.0;9.3.1;9.3.2;9.3.3;9.3.4;9.3.5;9.4.0;9.4.1;9.4.2;9.4.3;9.4.4;9.4.5"},{"Type":"MASTER","Line of Business":{"code":"LOB36","label":"IBM Automation"},"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Product":{"code":"SS5K6E","label":"IBM MQ Appliance"},"ARM Category":[{"code":"a8m0z00000008MzAAI","label":"Security"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.0.0;10.0.1;8.0.0;9.0.1;9.0.2;9.0.3;9.0.4;9.0.5;9.1.0;9.1.1;9.1.2;9.1.3;9.1.4;9.1.5;9.2.0;9.2.1;9.2.2;9.2.3;9.2.4;9.2.5;9.3.0;9.3.1;9.3.2;9.3.3;9.3.4;9.3.5;9.4.0;9.4.1;9.4.2;9.4.3;9.4.4;9.4.5"},{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSWN2J","label":"IBM MQ for z\/OS"},"ARM Category":[{"code":"a8m0z00000008MzAAI","label":"Security"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.0.0;9.0.0;9.1.0;9.2.0;9.3.0;9.4.0;and future releases"},{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSFE2G","label":"IBM MQ container software"},"ARM Category":[{"code":"a8m0z00000008MzAAI","label":"Security"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":""},{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSKM59","label":"IBM MQ for HPE NonStop"},"ARM Category":[{"code":"a8m0z00000008MzAAI","label":"Security"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.0.0;8.0.1;8.0.2;8.0.3;8.1.0"},{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQPN0","label":"IBM MQ Agent"},"ARM Category":[{"code":"a8m0z00000008MzAAI","label":"Security"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":""}]