PHP releases patches for critical remote-code flaws
The PHP project says unauthenticated attackers could execute code on vulnerable web servers.
The PHP project has released security updates for two critical vulnerabilities that can allow remote code execution. The PHP project advises organisations to update affected installations.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP installations serving web requests. The PHP project says the flaws involve memory handling and stale internal state, creating possible routes to unauthorised code execution.
The PHP project lists fixed versions including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project also says it published limited backports for some older branches, while warning that PHP 8.1 and earlier no longer receive normal support from the upstream project.
The Register reported that researchers had developed an exploit capable of bypassing Address Space Layout Randomisation on some x86-64 systems. The Register describes ASLR as a protection intended to make memory-corruption attacks harder by changing where program data is placed in memory.
The report also said the PHP Foundation had issued patches after researchers used AI tools to find the vulnerabilities. That does not mean the bugs were created by AI, nor that every vulnerable installation is being actively attacked. The Register reported proof-of-concept material and concern about future exploitation, but those reports do not establish widespread exploitation across the internet.
Organisations running self-managed PHP servers, including installations behind web applications and content-management systems, should check whether their installations require updating. The PHP project says updating is the complete remedy. According to the PHP project, temporary configuration changes may reduce exposure to particular attack paths, but are not a substitute for supported security updates.
Also show where in Europe and in the world
Fact-check Approved · Priya Shah — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article relies on the PHP security advisory for the vulnerability and fixes, with The Register for the exploit-development context. It avoids giving operational exploit instructions.
- confirmed PHP released updates fixing CVE-2026-109618 and CVE-2026-109619. — Confirmed by the PHP project. source
- confirmed The flaws can permit unauthenticated remote code execution. — Stated in the PHP security advisory. source
- confirmed A reported exploit bypasses ASLR on some x86-64 configurations. — Reported by The Register and attributed to VulnCheck. source
Editor's note
The vulnerability and fixed versions are confirmed by PHP. Claims about exploitation are reported cautiously because public evidence of widespread attacks is incomplete.Sources
More on this in other media
- Sky News — „php cybersecurity”
- BBC News — „php cybersecurity”
- The Guardian — „php cybersecurity”