PHP releases emergency patches for critical remote code execution flaws
The PHP project released emergency updates (8.5.12, 8.4.27, 8.3.36, 8.2.35) on Wednesday to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Rated 9.2/10 CVSS, these flaws allow unauthenticated attackers to execute code on servers via memory corruption. The UK’s NCSC and CERT-EU urge immediate patching or isolation, as early in-the-wild exploitation is already observed. This affects a vast portion of the web, from CMS platforms to government services.
Key points
- The PHP project, which maintains the widely used server-side scripting language, released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical security flaws.
- The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution through out-of-memory corruption and stale state issues, both rated 9.2/10 on the CVSS scale.
- Details of the flaws leaked a day before the patch release, prompting the UK’s National Cyber Security Centre (NCSC) and CERT-EU to advise organizations to patch immediately or isolate internet-facing applications.
- Security firm watchTowr reported early in-the-wild exploitation, noting that 'php2shell' user agents are hitting sensors, while the highest risk is identified for Apache mod_php deployments.
- Affected systems include PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, impacting a broad range of web applications, content management systems, and government services in Finland and the Netherlands.
- Developers emphasized that the risk is highest for mod_php, where an unauthenticated request can trigger the attack before application code runs, potentially leading to full server takeover.
The PHP project released emergency security updates on Wednesday to address two critical vulnerabilities that could allow unauthenticated attackers to execute code on web servers. The new releases, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, fix CVE-2026-109618 and CVE-2026-109619. Both flaws are rated 9.2 out of 10 on the Common Vulnerability Scoring System, indicating a high severity level that could lead to full remote code execution.
The first vulnerability, CVE-2026-109618, involves out-of-memory corruption where a request reaching PHP's memory limit at a specific moment leaves partially initialized data behind, which is later treated as valid. The second, CVE-2026-109619, involves stale state where a fatal error leaves internal state pointing to memory from a previous request. These issues affect various deployment configurations, including PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team noted that the risk is highest for mod_php, where an exploit can trigger before any application code runs.
Details of the flaws leaked online a day before the official patch release, prompting early advisories from cybersecurity authorities. The UK’s National Cyber Security Centre (NCSC) and CERT-EU urged organizations to install the fixes immediately or isolate internet-facing applications from public networks. Security firm watchTowr reported that in-the-wild exploitation has already begun, with various proof-of-concept scripts using 'php2shell' user agents hitting their sensors. While not all attacks have been successful yet, analysts expect successful takeovers to follow soon. This event highlights the ongoing security challenges for the language that powers a significant portion of the global web.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
