PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, at roughly 13:35 UTC on Wednesday. The releases fix CVE-2026-109618 and CVE-2026-109619, vulnerabilities rated 9.2 out of 10 that permit unauthenticated remote code execution. W3Techs estimates that PHP powers about 70% of websites whose server-side programming language is known. GoDaddy warned that attackers could exploit the flaws to steal information, alter websites or gain complete control of servers.
The PHP Foundation warned on Tuesday that two critical vulnerabilities would receive fixes on October 21, 2026, at 14:00 UTC, or earlier if necessary. A Hacker News user posted on Tuesday that disclosure would occur on Thursday, while acknowledging that the claim lacked supporting evidence. Security firm watchTowr confirmed that the vulnerabilities were real and subject to an embargo, and PHP advanced the release by one day. Cloudflare CTO Dane Knecht reported emerging attacks early Wednesday, nearly six hours before the patches became available. Cloudflare deployed emergency firewall rules for every customer, but Knecht described the protection as temporary.
CVE-2026-109618 causes PHP to treat incomplete data as finished after memory runs out during request processing. CVE-2026-109619 leaves data from an earlier visitor's request in memory where a subsequent request can encounter the data. PHP said servers running Apache's mod_php face the greatest risk because a demonstrated exploit executes before application code, bypassing login screens and WordPress security plugins. PHP Foundation researchers identified the upload-progress feature as a confirmed attack route; the feature has been enabled by default for over a decade despite limited use.
Public broadcaster Yle reported that Finland's state IT center, Valtori, began disconnecting public web services on Wednesday as a precaution. The Netherlands' national cybersecurity agency took its website offline. France's Interior Ministry said prefecture websites had been temporarily disconnected while awaiting a security patch. The NSA recommended that all organizations using PHP shut down their websites. CERT-EU advised organizations unable to patch to consider disconnecting internet-facing applications from public networks until a fix became available. Reuters reported similar advice from agencies in Australia, Japan and the United Kingdom.
Viral social media claims that affected PHP versions extended back to 2004 reflected early estimates covering PHP 5 onward, which CERT-EU acknowledged relied on social media posts. E-commerce security firm Sansec instead identified PHP 5.4 and later as affected, placing the starting point in 2012. PHP provides official releases only for version 8.2 and newer, leaving PHP 8.1 and older without an official release. However, PHP's security team supplied basic source-code patches for versions 7.4, 8.0 and 8.1. Linux distributions are also adapting fixes for older packages. Security firm Mallory counted about 884,000 internet-facing hosts advertising PHP 8.1 or older on October 20, representing 59% of roughly 1.5 million hosts disclosing versions. The number of websites behind those hosts is higher because shared-hosting servers can support multiple sites.
Some social media discussions incorrectly connected the PHP flaws with an unrelated Node.js security update scheduled for the same day. The PHP Foundation urged users of Remi's volunteer-maintained repository for Red Hat-style Linux servers to switch immediately to distribution packages or source builds because repository updates would not arrive that day. Ordinary users do not need PHP updates for phones, browsers or laptops; website operators and hosting companies are responsible for applying the fixes. Wordfence warned that automatic WordPress updates would not install the PHP fix and urged website owners to establish who manages server-level PHP updates. Website owners using PHP 8.1 or older need to plan an upgrade. PHP core developer Gina Peter Banyard said patching or upgrading PHP was the only mitigation. PHP 8.2 reaches end of life on December 31, 2026, after which the version will receive no further security patches.
Attackers can examine differences between old and patched code to identify the vulnerabilities once fixes become public. Sansec's forensics team expected widespread attacks to begin within 15 minutes after release. Akamai recorded attempts against decoy servers within 24 hours after disclosure of a different PHP vulnerability in June 2024. Attackers used DNS hijacking to redirect Compound and Celer front ends to wallet-draining pages in 2024, and Curve Finance experienced a similar attack in 2025. Those incidents did not involve PHP, but a compromised server can likewise deliver a convincing page that directs approved token transfers to attackers. Experts said in June that increasingly widespread use of advanced AI models to discover software vulnerabilities could expose many more flaws. WordPress security firm Wordfence, which says every WordPress site runs on a PHP server, was also offline.
PHP Releases Critical Security Patches for 2 Zero-Day Vulnerabilities Affecting 70% of Websites
OdailyShare
Summary
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21 to fix two critical security breach flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2. These flaws enable unauthenticated remote code execution and impact roughly 70% of PHP-powered websites. The PHP Foundation issued a warning on October 20, and global agencies urged services to disconnect until patched. Cloudflare and others rolled out temporary fixes, but PHP 8.1 and older versions need manual patching. Wordfence noted automatic WordPress updates won’t apply the fix, so site owners must check server-level PHP management. On-chain news platforms are closely tracking the impact.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.