PHP releases urgent fixes for critical remote-code vulnerabilities
publishers 23articles 26first reported 21 Oct, 10:36 UTCdeveloping since 21 Oct · 9 editions
PHP has released emergency updates for two critical flaws in its core runtime that can allow attackers to execute code remotely without authentication. The PHP project urged users serving web requests to install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately. PHP2Shell researchers said users should restart Apache, PHP-FPM and other long-running PHP workers.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, involve memory corruption during out-of-memory handling and internal state that can persist after its memory has been freed. Researchers demonstrated attacks against WordPress, Drupal and Joomla, but said the defects are in PHP itself and do not depend on a particular application. They can also expose sensitive process memory, including passwords, tokens, API keys and certificates.
PHP said all installations handling web requests may be at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. It assessed the risk as highest for mod_php, where an attack was demonstrated before application code runs. PHP 8.1 and older are no longer routinely supported by the project, though some vendors may provide backported fixes.
Government agencies in the Netherlands and Finland were among organizations that temporarily took websites offline as a precaution, the Bangkok Post reported. Cloudflare said it had observed early attacks and deployed firewall mitigations, while emphasizing that these were temporary protections. PHP said measures such as removing finite memory limits and restricting request sizes may reduce exposure to some attack paths, but only installing a fixed runtime provides a complete solution.
HOW THIS STORY WAS MADE
Written from 8 articles, 5 with the publisher's own text; 7 independent newsrooms once syndicated copies count as one; this version written 24 h after the record first saw the story; the editor revised it.
- Publishers
- 23
- Source articles
- 26
- Given to the writer
- 8, 5 with the article's own text
- Independent newsrooms
- 7
- This version written
- 24 h after the record first saw the story
- Second model (editor)
- revised
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and changed it before publication. Struck words were in the draft; underlined words are its corrections.
WHAT IT FLAGGED editor revise: Separate the PHP project's update guidance from the researchers' restart instruction to preserve accurate attribution. - "The PHP project urged users serving web requests to install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately and restart Apache, PHP-FPM and other long-running PHP workers.": PHP urged immediate installation of the fixed versions, but the restart instruction is attributed in the supplied material to the PHP2Shell researchers, not PHP.
THE DRAFT AND THE CHANGES
PHP releases urgent fixes for critical remote-code vulnerabilities
PHP has released emergency updates for two critical flaws in its core runtime that can allow attackers to execute code remotely without authentication. The PHP project urged users serving web requests to install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediatelyimmediately. andPHP2Shell researchers said users should restart Apache, PHP-FPM and other long-running PHP workers.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, involve memory corruption during out-of-memory handling and internal state that can persist after its memory has been freed. Researchers demonstrated attacks against WordPress, Drupal and Joomla, but said the defects are in PHP itself and do not depend on a particular application. They can also expose sensitive process memory, including passwords, tokens, API keys and certificates.
PHP said all installations handling web requests may be at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. It assessed the risk as highest for mod_php, where an attack was demonstrated before application code runs. PHP 8.1 and older are no longer routinely supported by the project, though some vendors may provide backported fixes.
Government agencies in the Netherlands and Finland were among organizations that temporarily took websites offline as a precaution, the Bangkok Post reported. Cloudflare said it had observed early attacks and deployed firewall mitigations, while emphasizing that these were temporary protections. PHP said measures such as removing finite memory limits and restricting request sizes may reduce exposure to some attack paths, but only installing a fixed runtime provides a complete solution.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →