PHP put out emergency security updates on Wednesday for two critical flaws that, the project said, can let an unauthenticated attacker execute code remotely. Its advice to users was to update immediately.
The patched releases are 8.5.12 for PHP 8.5, 8.4.27 for 8.4, 8.3.36 for 8.3 and 8.2.35 for 8.2. In its advisory, the project tied them to CVE-2026-109618 and CVE-2026-109619.
At risk, the advisory said, is any PHP installation that serves web requests — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed included. It said the risk is highest for mod_php, where a demonstrated exploit can be triggered by an unauthenticated request before any application code runs.
One flaw involves out-of-memory handling. The advisory said that handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid.
The second flaw involves stale global state. Request-owned internal state can survive after its backing memory has been freed, the advisory said, and a later request handled by the same worker may use that stale state before normal initialization resets it.
Cloudflare said Calif.io, Wiz, OpenAI and Quarkslab disclosed the two vulnerabilities, known as php2shell, and that they affect all web servers running PHP 5.4 or later. Cloudflare said the flaws may allow an attacker to cause denial of service, remote code execution and data exposure when an application processes specially crafted HTTP traffic.
PHP is used by almost 70% of websites, Cloudflare said. Because the flaws are in the PHP runtime itself, Cloudflare said updating website code or a plugin alone does not fix them, and administrators need to update the PHP software running their applications.
Cloudflare said customers using its free or paid web application firewall were protected by default from Oct. 21 at 3:02 a.m. UTC, about nine hours ahead of public disclosure. It said it observed attack traffic targeting its customers while the vulnerability was leaked before the official release date, and that attackers were mutating the attack payload to try to bypass its protections.
“Customers should patch their PHP repos even with WAF protections providing an additional layer of defense-in-depth mitigation,” Cloudflare said.
“There are no complete mitigations, updating is the only safe choice.”
— PHP development team
The PHP project said PHP 8.1 and older no longer receive updates from the project. It said some distributions and long-term support vendors provide backported fixes, and that its security team provided minimal source backports for PHP 7.4, 8.0 and 8.1 to help people building from source or without access to a vendor.
For users who cannot update immediately, the advisory said only an update is a complete solution. It listed measures that reduce exposure to specific attack paths, including setting session.upload_progress.enabled to 0 and restarting every worker to block the confirmed session paths for the stale-state flaw.
The PHP security team had given advance notice on Oct. 20 of a release scheduled for Oct. 21 at 14:00 UTC. It said it reserved the right to release earlier if details of either vulnerability became public or if evidence of active exploitation appeared.
Reuters reported that government websites in Europe and elsewhere went offline on Wednesday after the disclosure, as operators moved to protect their systems. Reuters also reported that the Trump administration said it was “tracking and coordinating with federal agencies and leading SI labs to expedite the release of the fix.”
OpenAI said: “Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory.”
The PHP project said Linux distributions and long-term support vendors received the patches in advance, so users should check their vendor for updated packages.
Have something to promote?
Bring your business, services or event to our readers.
