PHP patches two critical vulnerabilities after attacks emerge

PHP has released fixes for two critical remote code execution vulnerabilities after reports of attacks targeting the flaws. The PHP security team urged users to apply the patches as soon as possible.

The flaws, CVE-2026-109618 and CVE-2026-109619, received severity scores of 9.2/10. One involves out-of-memory handling; the other is a use-after-free error. The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP said Linux distributions and long-term support vendors received patches in advance, and advised users to check for updated packages.

According to Reuters, government, healthcare and education websites across Europe temporarily shut down after information about the flaws leaked two days before the fixes were released. Cloudflare CTO Dane Knecht said the company was seeing early attacks and updating its mitigations.

PHP said installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It described the risk as highest for mod_php, citing a demonstrated exploit that can be triggered by an unauthenticated request before application code runs.

PHP 8.1 and older will not receive fixes through the usual release process. The project said it provided minimal source backports for PHP 7.4, PHP 8.0 and PHP 8.1 for people building from source or without access to a long-term support vendor. PHP also outlined mitigations, while warning they are not a complete solution.