PHP Patches Two Server-Takeover Flaws

PHP has released emergency updates for two critical vulnerabilities that can let an unauthenticated attacker execute code on a web server. Administrators should move internet-facing systems to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now—and restart every PHP worker after the update.

Update — Oct. 26, 3:19 p.m. ET: A researcher has now published packet and process evidence of PHP2Shell reaching shell execution on three deliberately exposed PHP honeypots. The finding changes the evidence from exploit attempts to confirmed execution in that test setup; it does not establish production victims or a bypass of the available fixes. The new evidence and its limits are below.

The PHP security team says CVE-2026-109618 and CVE-2026-109619 affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Both flaws carry a 9.2 critical score. The team says updating is the only complete mitigation.

The most clearly demonstrated attack works against Apache mod_php before an application's own code begins. That detail matters: a careful WordPress plugin, Drupal module or custom input validator cannot stop a flaw that fires inside the language runtime while PHP is preparing the request.

Two memory failures, one dangerous result

CVE-2026-109618 involves out-of-memory handling. A specially shaped request can exhaust PHP's configured memory while internal request data is only partly initialized. Cleanup code may then process invalid state, creating a route to remote code execution. The official advisory confirms code execution over HTTP against common mod_php configurations; PHP-FPM appears susceptible by source analysis, although a complete FPM exploit had not been demonstrated when the advisory was published.

CVE-2026-109619 is a use-after-free problem across requests. Internal state owned by one request can remain after its backing memory has been released, allowing a later request handled by the same worker to encounter stale data before normal initialization replaces it. In both cases, exploitation runs with the permissions of the web-server worker—enough to alter site files, read accessible secrets or establish a foothold for further intrusion.

ENISA, CERT-EU, Europol and European national incident-response teams issued a joint call for immediate patching. They recommend inventorying PHP applications, coordinating with hosting providers, prioritizing public-facing systems and isolating anything that cannot be fixed promptly. Products may bundle PHP without advertising it, so checking only servers labeled “PHP” will miss part of the exposure.

The shutdowns were precautionary

The disclosure caused visible disruption before it produced evidence of a widespread breach. Reuters reports that government, hospital, school and other websites across Europe were taken offline as a precaution. Dutch government services, the Port of Rotterdam and several hospital sites were among them. Germany and Finland said their shutdowns were preventive, while Wikimedia temporarily disabled some systems as it applied fixes.

That evidence picture changed on Oct. 26. A published honeypot report correlates packet captures with process events showing 35 Apache-parented shell starts across three PHP targets on Oct. 24; SecurityWeek reviewed the findings. The disposable targets ran PHP 8.4.26 under single-worker Apache mod_php, before the PHP 8.4.27 fix. The report says the four-request chain fits CVE-2026-109618 and no second-stage payload download was observed. This is evidence of code execution in an intentionally favorable honeypot setup, not confirmation of a compromised production site, patched-version bypass or broad exploit reliability. Earlier crash and memory-error signals alone were not proof; the new packet-to-process correlation is materially stronger.

Supported PHP branches have complete releases available. PHP 8.1 and older are outside the project's normal support window; the security team published minimal source backports for 7.4, 8.0 and 8.1, and some operating-system or long-term-support vendors are shipping their own packages. Administrators should use their distribution or hosting provider's signed update rather than replacing managed packages with an ad hoc binary.

TINA's view: patch the runtime, then prove it

TINA's view: This is a drop-what-you-are-doing maintenance event for anyone operating exposed PHP. The combination of no required login, demonstrated server-side code execution and a flaw below the application layer makes waiting for a convenient maintenance window the riskier choice.

The strongest counterpoint is that exploit reliability depends on the PHP build, server interface, extensions and memory layout, and broad successful exploitation has not been established. That should shape incident claims, not delay the fix. A vulnerability does not need perfect reliability when automated attackers can send repeated requests across millions of hosts.

This judgment would soften if further analysis materially narrows the affected configurations. It would worsen if defenders confirm durable webshells, stolen secrets or a reliable exploit across PHP-FPM deployments. For now, the useful evidence is local: patched package versions, freshly restarted workers, clean logs and no obsolete runtime hiding behind a control panel. Install the fix, verify the process actually loaded it, and only then bring isolated services back.

This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.