PHP launches emergency solutions as some of the world’s largest websites say they were attacked by hackers
follow us
Add us as a preferred source on Google
- PHP released fixes for two critical remote code execution flaws and urged immediate patches
- Security researchers and Cloudflare reported early exploitation attempts before patches were available
- Millions of Internet-connected PHP installations may be at risk, especially unsupported legacy versions
PHP has released patches for two critical remote code execution (RCE) vulnerabilities and “strongly recommends” all users apply them as soon as possible, as hackers are starting to abuse the flaws in real-life attacks.
PHP issued a new security advisory saying it addressed CVE-2026-109618 and CVE-2026-109619 with a patch. The first is an out of memory handling error, while the second is a use after freeing error. Both were assigned a severity score of 9.2/10 (critical).
The vulnerabilities were fixed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can download the versions from the PHP download pages, with the Windows source code and binaries on the same page. Linux distributions and LTS vendors were said to have received the patches early, so users should check with their vendors for updated packages.
Latest videos ofTechnologyRadar
Shaking the foundations of the Internet
PHP is among the most popular programming languages for websites and web applications in the world, so when you encounter zero-days of remote code execution, it’s a big deal.
PHP was supposed to work on a solution quietly, not to give cybercriminals an advantage in exploitation. However, information about the vulnerabilities was leaked on the Internet two days in advance, causing great panic and, according to Reuters Several government, health and educational websites across Europe decided to temporarily close to avoid being attacked.
Different sources made different claims. For example, Florian Roth, head of research at Nextron Systems, said that both flaws would receive a severity score of 10/10, which did not happen. He also said that only PHP 8 would be patched, which turned out to be true, even though other sources claim that PHP up to version 5 is fixed.
This is also a big problem, as it’s safe to say that millions of websites are running older, end-of-life versions of PHP, and could now be attacked relatively easily. Citing VirusTotal, beepcomputer said that more than 5.1 million PHP hosts are currently exposed online, and about 3.8 million have at least one port open.
According to PHP, “all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed,” are at risk. “We consider the risk to be highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code is executed.”
Unsupported versions
PHP 8.1 and earlier will not be fixed, so if you are running any of those versions, you are at risk. Cloudflare CTO Dane Knecht said the company is “watching the first attacks emerge” and is updating mitigations as new vectors appear. This was a few hours before PHP released the fixes. “Given the severity of these vulnerabilities, the PHP security team provided minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people build from source code or without access to an LTS provider,” PHP added.
The safest thing here is to update PHP. For those who can’t do it out of the box, PHP recommends some mitigations, but emphasizes that they are not a complete solution. For the out-of-memory fault, maintainers recommend setting memory limits appropriately and restricting the size of incoming requests, including file uploads, to reduce the risk of memory-related attacks. It was said that administrators can use container limits to prevent a vulnerable worker from affecting the overall system.
For post-free use, PHP says administrators can disable session loading progress tracking and enable fatal error traces (in PHP 8.5). They should also fix application errors that could cause crashes or timeouts and avoid outdated configurations that generate error messages before the application fully initializes.
Through beepcomputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment