PHP Official Urges Immediate Update to Fix Critical RCE Vulnerabilities

iconKuCoinFlash
Share
AI summary iconSummary
PHP has issued a security advisory urging users to apply updates immediately to address two critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These flaws allow unauthenticated attackers to execute malicious code. PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed are affected, with Apache mod_php at higher risk. Patched versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users on PHP 8.1 or older should upgrade or contact their provider. Temporary fixes are ineffective—only immediate patching resolves the issue. This update is critical for maintaining system security, particularly during the BTC and ETH update cycles.

Odaily Planet Daily report: The PHP official team has released a security advisory addressing two previously disclosed critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Attackers may exploit these vulnerabilities to execute malicious code without authentication. The PHP official team strongly recommends that all users upgrade immediately.

This vulnerability affects PHP environments that handle web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, with Apache mod_php posing the highest risk, as attacks can be triggered before application code executes.

The official has released patched versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users still on PHP 8.1 or earlier should contact their distribution or long-term support (LTS) provider to confirm patch availability, or upgrade to a supported version. The official emphasizes that temporary workarounds cannot fully eliminate the risk, and installing security updates immediately is the only way to fully resolve the vulnerability.

Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.