Abstract:
The PHP development team officially released an emergency security update on October 21, 2026, to fix two serious security vulnerabilities. These two vulnerabilities are numbered CVE-2026-109618 and CVE-2026-109619 respectively. Both are rated as severe and may allow attackers to execute code remotely without logging in. Officials strongly recommend that all PHP users immediately upgrade to the repaired version to avoid server attacks.
The fixed versions released this time include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Officials pointed out that the vulnerability affects PHP deployment environments that handle requests through the network, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team specifically emphasized that the environmental risks of using Apache mod_php are of particular concern, as there have been demonstrations that attackers can trigger attacks before application code begins to execute.
The first vulnerability, CVE-2026-109618, is related to the memory exhaustion handling mechanism. When PHP encounters insufficient memory, the program may interrupt the processing flow when the internal request data has not been fully initialized, and then use these invalid data as valid data when cleaning up resources. This abnormal state can lead to memory corruption and can be further exploited under certain conditions, ultimately achieving remote code execution.
The second vulnerability, CVE-2026-109619, involves freed memory and expired internal state. Some internal states belonging to the current request may still remain after the corresponding memory is released. Subsequent requests handled by the same worker process may use stale data before normal initialization resets these states, causing security issues. Both vulnerabilities may allow attackers to break through the original program execution boundaries.
The CVSS v4.0 score of both vulnerabilities is 9.2, which is a serious level. The danger is that an attacker may not need a valid account, password, or other authentication credentials to trigger the vulnerability by crafting specific network requests. If the attack is successful, the attacker may further execute malicious commands, steal data, plant malicious programs, or use server privileges to continue to expand the scope of the intrusion.
PHP is one of the most common server-side programming languages in Internet applications and is widely used for dynamic web page generation, database interaction and background business processing. Content management systems such as WordPress also rely on PHP to run, so this vulnerability does not only affect a certain website platform, but involves the underlying operating environment. Even if a website has updated the WordPress core program and plugins, the website may continue to be at risk as long as the PHP version on the server is still vulnerable. WordPress officials also made it clear that this problem does not need to be solved by releasing a WordPress core update. Website owners should check and update the actual running PHP environment.
For websites using supported branches of PHP 8.2 and above, administrators should install the corresponding repair version as soon as possible. Users who are still using PHP 8.1 and earlier versions need to pay special attention: these versions no longer receive security updates directly provided by the PHP project. However, some Linux distributions, long-term support providers or other suppliers may provide rollback patches, and relevant users should confirm with their software vendors whether there is a fix.
Security agencies have previously warned that if the website cannot fix the vulnerability in time, it should consider temporarily restricting external access and taking the system offline if necessary. The disclosure of this vulnerability also triggered emergency responses from many countries and regions. Some European government agencies took the initiative to shut down websites before the patch was released to reduce potential risks. Reuters reports that some government agencies in the Netherlands and Finland have taken preventive measures, reflecting the actual pressure this security incident has put on public network services.
PHP’s official emergency release of patches means that security issues that were previously in the warning stage have entered the actual repair stage. For website operators, the most important task right now is to confirm the version of PHP that the server is actually running, check whether the hosting provider has deployed updates, and check the system for abnormal processes, unauthorized file modifications, or suspicious network connections.
Website security depends not only on the application itself, but also on whether the underlying operating environment is maintained in a timely manner. Since PHP is widely deployed on various websites and servers, timely installation of official repair versions is a key measure to reduce the risk of these two serious vulnerabilities.
Learn more:
https://www.php.net/archive/2026.php#2026-10-21-5
https://www.php.net/downloads.php
Comments