AI News Feed
Market watch
Tesla targets Cybercab sales by end of 2026Security Bite Podcast Asks Who an AI Agent Really Works ForNPR Life Kit Offers Five Practical Ways to Ease Desk-Related AchesDream Incubation Gets Renewed Look From Researchers and CliniciansAI Inference Leaves a Hidden Storage Bill, MIT Technology Review SaysPHP Patches Two Critical RCE Flaws After Early Exploitation Attempts
Tesla targets Cybercab sales by end of 2026Security Bite Podcast Asks Who an AI Agent Really Works ForNPR Life Kit Offers Five Practical Ways to Ease Desk-Related AchesDream Incubation Gets Renewed Look From Researchers and CliniciansAI Inference Leaves a Hidden Storage Bill, MIT Technology Review SaysPHP Patches Two Critical RCE Flaws After Early Exploitation Attempts
Cybersecurity

PHP Patches Two Critical RCE Flaws After Early Exploitation Attempts

PHP patched two critical RCE flaws after early attacks, with millions of installations potentially at risk.

AI News Feed · 2026-10-22 19:11

The flaws are CVE-2026-109618, an out-of-memory handling bug, and CVE-2026-109619, a use-after-free memory error. Both were rated 9.2 out of 10 for severity. PHP addressed them in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which are available from its downloads pages; Windows source code and binaries are on the same page. Linux distributions and LTS vendors received the patches in advance, PHP said, so users should check with their vendors for updated packages.

PHP is one of the most widely used programming languages for websites and web applications, and the disclosure drew urgent attention because the flaws could allow remote code execution. According to Reuters, multiple government, healthcare and education websites across Europe temporarily shut down to avoid being targeted. TechRadar reported that websites around the world were scrambling to confirm they were protected, and that users had reported issues with some sites as the story developed.

Exposure is broad. BleepingComputer, citing VirusTotal, said more than 5.1 million PHP hosts are currently exposed online, with about 3.8 million having at least one port open. Millions of websites are also running older, end-of-life PHP versions. PHP said PHP 8.1 and older will not receive standard fixes; it provided minimal source-backports for PHP 7.4, PHP 8.0 and PHP 8.1 to help people building from source or without access to an LTS vendor.

There were conflicting claims around the disclosure. Florian Roth, head of research at Nextron Systems, said both flaws would be given a 10/10 severity score, but PHP assigned 9.2. Roth also said only PHP 8 would be patched; that proved true, despite other sources claiming versions down to PHP 5 were fixed.

PHP said all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It said the risk is highest for mod_php, with a demonstrated exploit in which an unauthenticated request can trigger the attack before any application code runs. Cloudflare CTO Dane Knecht said the company was "seeing early attacks emerging" and updating mitigations as new vectors appeared, according to TechRadar; that was a few hours before PHP released the fixes.

Updating remains the safest option. For administrators who cannot update immediately, PHP recommended mitigations but stressed they are not a complete solution. For the out-of-memory flaw, it recommended setting appropriate memory limits, restricting the size of incoming requests including file uploads, and using container limits to prevent a vulnerable worker from affecting the wider system. For the use-after-free flaw, it recommended disabling session upload progress tracking and enabling fatal-error backtraces on PHP 8.5, fixing application errors that could trigger crashes or timeouts, and avoiding outdated settings that generate error messages before the application is fully initialized.