Emergency PHP patches close severe remote-code-execution holes
PHP maintainers released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated remote code execution on web servers. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and every PHP installation serving web requests is affected, with mod_php setups facing the greatest risk. Researchers warned that frontier AI models helped turn long-standing flaws into practical exploits, while the UK's NCSC advised taking systems offline if they cannot be patched promptly.
The emergency releases address two distinct memory-handling faults: one tied to out-of-memory conditions that can leave request data partly initialized, and another involving stale internal state that may persist after memory is freed. Both can be reached before application code executes, and a single unauthenticated request has been demonstrated to trigger exploitation.
Affected deployments include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed; mod_php carries the highest exposure. Distributions and long-term-support vendors received fixes before publication, while users of a volunteer-maintained repository were told to switch packages or compile from source. Cloudflare also deployed WAF rules for known exploit vectors.
Because PHP underpins many web services, unpatched servers could expose login pages, APIs, and embedded appliances to unauthenticated compromise. Organizations that cannot update promptly may face service disruption if they follow advice to go offline, while forgotten or embedded installations could remain exposed for years. The practical burden may fall hardest on small operators and maintainers of legacy systems, though Cloudflare’s WAF rules could reduce risk for some sites.