PHP releases emergency fixes as some of the world's biggest websites say they were targeted by hackers

Date:
Thu, 22 Oct 2026 08:58:36 +0000

Description:
PHP urges organizations to deploy the fixes immediately, as threat actors start abusing the php2shell bug

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter PHP released fixes for two critical remote code execution flaws and urged immediate patching Security researchers and Cloudflare reported early exploitation attempts before
patches became available Millions of internet-facing PHP installations may be at risk, especially unsupported legacy versions PHP has released patches for two critical remote code execution (RCE) vulnerabilities and strongly encouraged all users to apply them as soon as possible, as hackers are starting to abuse the flaws in real-life attacks.

PHP issued a new security advisory saying it addressed CVE-2026-109618 and CVE-2026-109619 with a patch. The former is an out-of-memory handling bug, while the latter is a use-after-free memory error. Both were assigned a severity score of 9.2/10 (critical). The vulnerabilities were addressed in
PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can download the versions from PHPs downloads pages, with Windows source and binaries being on the same page. Linux distributions and LTS vendors received the patches in advance, it was said, so users should check with their vendors for updated packages. Latest Videos From TechRadar Watch full video here: Shaking the internets foundations PHP is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, its a big deal.

PHP was supposed to work on a solution in silence, not to give cybercriminals a head start on exploitation. However, information about the vulnerabilities leaked on the internet two days in advance, causing serious panic, and according to Reuters multiple government, healthcare, and education websites across Europe decided to temporarily shut down to prevent being targeted. You may like Website admins across the world bracing for impact following major PHP flaw reveal Hackers are targeting a critical WordPress flaw, so be on
your guard Third-party WooCommerce plugin hits WordPress sites with PHP backdoor abusing recently patched vulnerability

Different sources made different claims. For example, Florian Roth, Head of Research at Nextron Systems, said both flaws would be given a 10/10 severity score, which did not happen. He also said only PHP 8 would be patched, which turned out to be true, despite other sources claiming PHP down to version 5 being fixed.

This, too, is a huge deal, since its safe to say that millions of websites
are running older, end-of-life PHP versions, and could now be targeted with relative ease. Citing VirusTotal, BleepingComputer said more than 5.1 million PHP hosts are currently exposed online, with some 3.8 million having at least one port open. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

According to PHP, all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, are at risk.We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any
application code runs. Unsupported versions PHP 8.1 and older will not be fixed, so if youre running any of those versions, youre in danger.
Cloudflares CTO, Dane Knecht, said the company is seeing early attacks emerging and is updating mitigations as new vectors show up. This was a few hours before PHP released the fixes. Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor, PHP added.

The safest play here is to update PHP. For those that cannot do that immediately, PHP recommends a few mitigations, but stresses that these are
not a complete solution. For the out-of-memory flaw, the maintainers
recommend setting memory limits appropriately, and restricting the size of incoming requests, including file uploads, to reduce the risk of memory-related attacks. Admins can use container limits to prevent a vulnerable worker from affecting the wider system, it was said.

For the use-after-free one, PHP says admins can disable session upload progress tracking and turn on fatal-error backtraces (on PHP 8.5). They
should also fix application errors that could trigger crashes or timeouts and avoid outdated settings that generate error messages before the app is fully initialized.

Via BleepingComputer The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/php-releases-emergency-fixes-as-some-of -the-worlds-biggest-websites-say-they-were-targeted-by-hackers


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)