Posted by The PHP Group has released security updates to address two critical vulnerabilities that could allow attackers to execute code remotely without authentication, according to an announcement on its official website.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were addressed through security releases issued on October 21. Both were rated 9.2 on the Common Vulnerability Scoring System (CVSS) version 4.0 scale.
The fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The group said there were no complete mitigations for the vulnerabilities and that updating was the only safe choice.
According to the security advisory, all PHP installations serving web requests are at risk. These include deployments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The group identified Apache’s mod_php configuration as the highest-risk setup, noting that a demonstrated exploit could trigger an attack through an unauthenticated request before any application code runs.
The first vulnerability, CVE-2026-109618, involves an out-of-memory handling issue that can interrupt PHP while internal request data is only partially initialised. During request cleanup, the system may then treat invalid data as valid, creating a potential path to remote code execution.
The second vulnerability, CVE-2026-109619, involves stale internal state. Information associated with a request can persist after the memory backing it has been freed. A subsequent request handled by the same worker may use that stale state before normal initialisation resets it, potentially allowing an attacker to execute code remotely.
These vulnerabilities have also prompted temporary shutdowns of websites and online services worldwide as organisations moved to protect their systems. Reuters reported that government agencies, hospitals, companies and other institutions in several countries took services offline as a precaution while preparing to apply security updates.
Hundreds of websites were down on October 21 as administrators responded to the flaws, reported The Record.
“When governments are choosing to take their own websites offline rather than risk leaving them exposed, it gives you a pretty clear indication of how seriously this is being taken,” commented Charlotte Wilson, Head of Enterprise – Check Point Software Technologies.
“The immediate priority is getting systems updated, but the bigger question is whether we’ve become too dependent on technology that can leave so many organisations vulnerable at exactly the same time,” added Wilson.
In fact, PHP is used by 69.3% of websites whose server-side programming language is known, according to W3Techs, highlighting the technology’s broad reach and the importance of addressing security flaws affecting it.
“One thing organisations must keep in mind with PHP2Shell is that because this flaw triggers inside the core PHP engine before any application code executes, traditional application-level safeguards won’t stop it,” Niv Lanyado, JFrog Security Research team lead on PHP commented on the risk posed by the vulnerabilities.
“Organisations cannot rely on code-level workarounds; automated visibility across all environments – especially identifying legacy or end-of-life PHP installations that won’t receive vendor binary updates – is essential to ensuring every endpoint is patched or isolated immediately,” added Lanyado.
The PHP Group has advised users to install the appropriate fixed release. Linux distributions and long-term support vendors received the patches in advance, and users have been advised to check with their vendors for updated packages.
Installations running PHP 8.1 and older require particular attention because these versions no longer receive
updates from the PHP project. Some distributions and long-term support vendors provide backported fixes. Users have been advised to contact their vendors for details or upgrade to a supported version.
The PHP security team has also provided minimal source-code backports for PHP 7.4, 8.0 and 8.1. These are intended to help users who build PHP from source or do not have access to a long-term support vendor.
The group has outlined temporary measures that can reduce exposure to specific attack paths for users unable to update immediately. However, it has cautioned that these measures do not make an installation safe. Applying the security updates remains the only complete solution.
The vulnerabilities highlight the importance of identifying and securing software that may run in the background across business environments, according to Dr. Gaurav Nigam, COO and Whole-time Director of Wepsol.
“The recent PHP vulnerabilities are a reminder that security risk often sits in software running quietly in the background. Many SMEs and medium-sized organisations in India still run business applications on PHP because of its low cost and large talent pool,” said Nigam.
Further, “Flaws that allow remote code execution without authentication leave little room for delay. With fixes now available for supported versions, speed matters, as attacks were reported even before patches were public,” added Nigam.