PHP has released emergency updates for two critical vulnerabilities that can let an unauthenticated attacker execute code on a web server. Administrators should move internet-facing systems to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now—and restart every PHP worker after the update.
The PHP security team says CVE-2026-109618 and CVE-2026-109619 affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Both flaws carry a 9.2 critical score. The team says updating is the only complete mitigation.
The most clearly demonstrated attack works against Apache mod_php before an application's own code begins. That detail matters: a careful WordPress plugin, Drupal module or custom input validator cannot stop a flaw that fires inside the language runtime while PHP is preparing the request.
Two memory failures, one dangerous result
CVE-2026-109618 involves out-of-memory handling. A specially shaped request can exhaust PHP's configured memory while internal request data is only partly initialized. Cleanup code may then process invalid state, creating a route to remote code execution. The official advisory confirms code execution over HTTP against common mod_php configurations; PHP-FPM appears susceptible by source analysis, although a complete FPM exploit had not been demonstrated when the advisory was published.
CVE-2026-109619 is a use-after-free problem across requests. Internal state owned by one request can remain after its backing memory has been released, allowing a later request handled by the same worker to encounter stale data before normal initialization replaces it. In both cases, exploitation runs with the permissions of the web-server worker—enough to alter site files, read accessible secrets or establish a foothold for further intrusion.
ENISA, CERT-EU, Europol and European national incident-response teams issued a joint call for immediate patching. They recommend inventorying PHP applications, coordinating with hosting providers, prioritizing public-facing systems and isolating anything that cannot be fixed promptly. Products may bundle PHP without advertising it, so checking only servers labeled “PHP” will miss part of the exposure.
The shutdowns were precautionary
The disclosure caused visible disruption before it produced evidence of a widespread breach. Reuters reports that government, hospital, school and other websites across Europe were taken offline as a precaution. Dutch government services, the Port of Rotterdam and several hospital sites were among them. Germany and Finland said their shutdowns were preventive, while Wikimedia temporarily disabled some systems as it applied fixes.
Cloudflare reported early attack attempts, but that is not the same as confirmed successful exploitation. Several national authorities said they had not observed attacks on their own systems. The right posture is urgent patching without inventing victims or treating every temporary outage as proof of compromise.
Supported PHP branches have complete releases available. PHP 8.1 and older are outside the project's normal support window; the security team published minimal source backports for 7.4, 8.0 and 8.1, and some operating-system or long-term-support vendors are shipping their own packages. Administrators should use their distribution or hosting provider's signed update rather than replacing managed packages with an ad hoc binary.
TINA's view: patch the runtime, then prove it
TINA's view: This is a drop-what-you-are-doing maintenance event for anyone operating exposed PHP. The combination of no required login, demonstrated server-side code execution and a flaw below the application layer makes waiting for a convenient maintenance window the riskier choice.
The strongest counterpoint is that exploit reliability depends on the PHP build, server interface, extensions and memory layout, and broad successful exploitation has not been established. That should shape incident claims, not delay the fix. A vulnerability does not need perfect reliability when automated attackers can send repeated requests across millions of hosts.
This judgment would soften if further analysis materially narrows the affected configurations. It would worsen if defenders confirm durable webshells, stolen secrets or a reliable exploit across PHP-FPM deployments. For now, the useful evidence is local: patched package versions, freshly restarted workers, clean logs and no obsolete runtime hiding behind a control panel. Install the fix, verify the process actually loaded it, and only then bring isolated services back.
This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
