Critical PHP Vulnerabilities Put Millions of Websites at Risk
Emergency patches released as hackers actively exploit remote code execution flaws.
A Critical Threat for PHP Users
The popular programming language PHP has released emergency updates to patch two critical Remote Code Execution (RCE) vulnerabilities. Security experts warn that the threat is severe, as hackers are already actively attempting to exploit unprotected servers. Identified as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities have been assigned a severity score of 9.2 out of 10.
The first flaw involves improper memory handling, while the second is a "use-after-free" memory error. Both vulnerabilities allow attackers to execute arbitrary code on a server, often leading to a complete system takeover. According to the official PHP statement, all installations serving web requests are at risk, including Apache (mod_php), PHP-FPM, FrankenPHP, and LiteSpeed servers.
Cyberattacks and Data Leaks
The situation escalated after details regarding the vulnerabilities were leaked two days before the official patches were released, providing cybercriminals with a window of opportunity. Across Europe, various government, educational, and medical institutions temporarily suspended their websites as a precautionary measure. Security firms, including Cloudflare, confirmed that the initial waves of attacks began before the patches were even available.
Updates are now available for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your server runs PHP 8.1 or older, you should be aware that official support for these versions has ended and they no longer receive security updates. However, the PHP security team has made an exception, providing minimal technical support for versions 7.4, 8.0, and 8.1 to help users secure their systems.
How to Protect Your System
The most effective defense is to upgrade to the latest version of PHP. However, in cases where an immediate update is not possible, developers recommend several temporary measures. To mitigate memory-related attacks, it is advised to strictly control memory limits and restrict the size of incoming files. Additionally, it is recommended to disable session upload progress tracking and ensure that application errors are handled in a way that does not cause system crashes.
For web developers and system administrators, this news is critically important. As millions of websites continue to operate on outdated PHP versions, the risk remains high. We advise you to immediately check your server configurations and ensure that the latest security patches are installed to prevent data leaks or unauthorized server access.