MikroTik takes web services offline for a few hours due to a PHP vulnerability: RouterOS is not affected

What did MikroTik announce?

This morning at 11:14 (Italian time), MikroTik posted in the Announcements section of its forum that PHP has announced a very serious vulnerability and that, at that moment, a fix was not yet available. For this reason, MikroTik is shutting down all potentially vulnerable web services until they are secure, and warns that some accounts will not work for a few hours. It also clarifies that the forum does not use PHP and remains open.

This is a prudent choice: instead of leaving a site that could be compromised running, it is shut down until it is updated.

Are my MikroTik routers at risk?

No. RouterOS does not contain PHP: WebFig, WinBox, the API, and other router services are not written in PHP, and MikroTik has not reported any issues with routers or SwOS. The announcement concerns only the company’s websites.

You do not need to update RouterOS or change your configuration for this vulnerability. The standard rules still apply: management services must never be exposed to the internet, as I explain in the Basic Hardening how-to.

What is still working and what is not?

I checked at 17:00 today:

In practice:

• updating a router works: /system package update check-for-updates and then install use upgrade.mikrotik.com and download.mikrotik.com, which are active;
• the manual is accessible normally, including from links in my articles;
• anything that goes through your mikrotik.com account may not work until the site is back up: access to the customer area and, probably, license operations (for example, CHR licenses).

If you need something from your account, wait a few hours and try again: MikroTik mentioned a temporary interruption.

What are the PHP vulnerabilities?

There are two, published today:

• CVE-2026-109618, “RCE via OOM corruption”: when PHP runs out of memory (out of memory), it interrupts the request in a way that, in certain cases, leaves uninitialized data; subsequent cleanup reads this data, which can lead to remote code execution;
• CVE-2026-109619, “RCE via stale global state”: some PHP global variables may continue to point to memory already freed by a previous request; here too, the outcome can be remote code execution.

Both have a CVSS 4.0 score of 9.2, critical severity: they are exploitable from the network and do not require credentials, although exploitation is not trivial (high complexity). All currently supported versions of PHP are affected:

At the time of MikroTik’s announcement, the fix was not yet available; now the fixed versions have been released by the PHP project. Linux distributions and package repositories may take a few more hours to update.

What should I do if I use PHP?

If you have servers with PHP exposed to the internet, this vulnerability directly affects you. This is common in the MikroTik world: hotspot management panels, WISP billing systems, external captive portals, as well as standard WordPress sites. Many of these communicate with routers via API: if the server is compromised, the attacker also gains access to your routers’ API credentials.

1. Update PHP to the fixed version for your branch (table above) as soon as the package is available for your system, and restart PHP-FPM or the web server.
2. Until you can update, consider what MikroTik did: if a panel is not needed by everyone, restrict its access to the addresses that actually use it, or disable it for a few hours.
3. If a PHP panel uses an API user on the router, ensure that user has only the necessary permissions and a address= limited to the server’s IP (in /user).

Where can I find the sources?

• MikroTik’s announcement on the forum: PHP vulnerability and mikrotik services
• PHP project advisories: GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)