{"id":16849,"date":"2026-10-21T21:33:00","date_gmt":"2026-10-21T21:33:00","guid":{"rendered":"https:\/\/newestek.com\/?p=16849"},"modified":"2026-10-21T21:33:00","modified_gmt":"2026-10-21T21:33:00","slug":"two-critical-php-flaws-put-the-web-on-alert-as-emergency-patches-arrive","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16849","title":{"rendered":"Two critical PHP flaws put the web on alert as emergency patches arrive"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code execution (RCE).<\/p>\n

On Wednesday morning, the PHP Foundation released patches for affected versions, and said it is \u201cimperative\u201d that organizations running PHP patch immediately. It said that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where an unauthenticated request can trigger exploitation before application code runs.<\/p>\n

In response to the disclosures, some government websites in Europe, including those in the Netherlands and Finland, as well as those of other organizations worldwide, went offline as a precautionary measure.<\/p>\n

PHP is \u2018the web itself\u2019<\/h2>\n

PHP is a widely-used, open source server-side scripting language that underlies websites<\/a> like WordPress, which powers 43% of the web<\/a>, as well as Mailchimp, Drupal, Magento, Laravel, and parts of Slack and Zoom, and numerous others.<\/p>\n

The impact is not limited to websites, noted the Netherlands National Cyber Security Centre (NCSC-NL) in its description of the flaws, collectively dubbed PHP2Shell<\/a>. PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly. And CERT-EU, an organization that tracks cybersecurity threats in the European Union, also warned that many commercial and open-source products<\/a> use PHP as a backend technology, and these could be also impacted by the flaws, even if they do not directly expose a PHP installation.<\/p>\n

This makes the vulnerabilities all the more serious. CVE-2026-109618<\/a>, which has a 9.2 severity rating on the common vulnerability and scoring system (CVSS), could allow RCE via memory corruption during out-of-memory handling (OOM), a strategy that operating systems (OSes) and apps use when physical RAM and swap spaces become exhausted.<\/p>\n

CVE-2026-109619,<\/a> also with a score of 9.2, remote code execution via stale request-owned global state reused by a later request on the same worker.<\/p>\n

Both flaws sit in parts of PHP that nearly every request touches: Memory management and error handling, the PHP Foundation noted<\/a>. This makes both bugs extremely serious, and also difficult to fix without impacting compatibility or performance. Organizations should begin with the assumption that they are exposed<\/a>.<\/p>\n

\u201cWhat makes these vulnerabilities significant is where they sit,\u201d said Forrester senior analyst Madelein van der Hout<\/a>. PHP underpins 70% of websites, making this a huge concentration risk.<\/p>\n

\u201cChecking the corporate website alone is not enough,\u201d she said. \u201cOrganizations need to establish where they are exposed and prioritize internet-facing systems.\u201d<\/p>\n

Affected organizations should update<\/a> to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux and long-term support (LTS) vendors received patches in advance, the Foundation said, so organizations should check with their vendors about fixes.<\/p>\n

PHP 8.1 and other end of life versions no longer receive updates from the PHP project, although some distributors and LTS vendors provide backported fixes, so organizations still running unsupported versions should also check with their vendor.<\/p>\n

Those relying on the volunteer-maintained rpms.remirepo.net<\/a> should switch distribution packages or build from source to immediately apply updates, the PHP Foundation advised.<\/p>\n

Those unable to patch immediately should take the preventive action<\/a> it described to reduce exposure, CERT-EU said, warning that these mitigations do not make an installation safe.<\/p>\n

\u201cThis is what an internet-scale vulnerability looks like,\u201d said Neatsun Ziv<\/a>, CEO of runtime app security company OX Security. \u201cWhen a flaw hits technology this ubiquitous, the blast radius isn\u2019t one product or one industry. It\u2019s the web itself.\u201d<\/p>\n

Researchers from his company independently reproduced the flaws and found that the vulnerable functionality is enabled by default, and has existed in PHP since version 5.4.<\/p>\n

Still, experts emphasize that patching is just one element of response. Speed matters, Forrester\u2019s van der Hout noted, and security teams need to identify everywhere PHP is running, prioritize exposed systems, apply the official fixes promptly and investigate for signs of compromise.<\/p>\n

\u201cA patch fixes the vulnerability; it does not necessarily remove access an attacker may already have established,\u201d she said.<\/p>\n

Offline does not mean hacked<\/h2>\n

With rumors of exploits already available on the dark web, taking services down to protect and then patch them is a pragmatic choice, experts say.<\/p>\n

Forrester\u2019s van der Hout emphasized that taking a website offline does not mean it has been hacked. If an organization cannot yet patch or adequately protect a potentially vulnerable system, temporarily taking it offline can be a \u201cproportionate risk decision.\u201d That is, organizations accept a short loss of availability rather than risk a potential serious compromise.<\/p>\n

Ultimately, this is a test of operational resilience, rather than just patch management, van der Hout said. Organizations must decide whether they can keep services running, and who has the authority to take them offline if necessary.<\/p>\n

\u201cA temporary shutdown can be the right decision, but it shows how a software vulnerability can become a business disruption even without a confirmed breach,\u201d she said.<\/p>\n

AI\u2019s role in defense, as well as hacking<\/h2>\n

OpenAI has posted a blog<\/a> detailing its role in the PHP response, explaining that red-teaming organization Calif identified a critical flaw using GPT\u20115.6 Sol as part of OpenAI\u2019s Patch the Planet initiative. Wiz also independently discovered and reported both vulnerabilities, and OpenAI partners contributed research, technical support, and coordination ahead of PHP\u2019s disclosure.<\/p>\n

OpenAI is sharing a PHP version checker<\/a> as a Codex skill to help organizations identify vulnerable PHP versions and apply the right updates.<\/p>\n

\u201cGiven the severity of these flaws and PHP\u2019s widespread use, we consider this one of the most impactful security issues in recent memory,\u201d OpenAI said.<\/p>\n

The company also indicated that this is a turning point in AI\u2019s role in security<\/a>; frontier AI discovered the vulnerabilities before attackers did, giving maintainers a head start, a \u201cdefender\u2019s window<\/a>.\u201d<\/p>\n

\u201cIt highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,\u201d OpenAI noted.<\/p>\n

Matt Saunders<\/a>, DevOps lead at global technology provider The Adaptavist Group, emphasized the latter point: \u201cAs soon as the vulnerability is announced, legions of AI bots will be looking for systems to exploit,\u201d he said, pointing out that these bots can chain together multiple lower-vulnerability attacks combined with these new critical ones to hack into organizations.<\/p>\n

This means, he said, \u201cthe blast radius from a breach is potentially much wider now with AI-embellished attacks available to those who choose to use them.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code execution (RCE). On Wednesday morning, the PHP Foundation released patches for affected versions, and said it is \u201cimperative\u201d that organizations running PHP patch immediately. It said… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16849","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16849","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16849"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16849\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16849"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16849"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16849"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}