PHP team issues emergency patches for critical remote code execution flaws

The PHP development team announced emergency security updates that fix two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution on web servers. The patches are included in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is urging all PHP users to apply the updates without delay.

"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," explained researchers at Wiz.

All PHP installations that serve web requests are affected, including PHP-FPM, Apache with modphp, php-cgi, FrankenPHP and LiteSpeed, with modphp deployments facing the greatest risk. A working exploit has demonstrated that a single unauthenticated request can trigger the attack before any application code runs.

"The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years," noted security researcher Kevin Beaumont.

The UK National Cyber Security Centre (NCSC) advises organizations to consider taking offline any systems that cannot be patched immediately.

"So many embedded installations out there that will never be patched. Too many forgotten, unmaintained apps. There will be a long tail for this one," commented computer forensics expert Hal Pomeranz.

To remediate the vulnerabilities, users should upgrade to the patched PHP versions mentioned above. Linux distributions and long-term support vendors have received the patches ahead of the public release, so administrators should verify availability with their vendors. The PHP project no longer supports PHP 8.1 and earlier; however, some vendors provide backported fixes for those releases. Users relying on the volunteer-maintained repository rpms.remirepo.net are advised to switch to distribution packages or build PHP from source, as the repository will not receive updates today.

For environments that cannot upgrade to a supported release, the PHP security team has also provided minimal source backports for PHP 7.4, 8.0 and 8.1, intended for those who compile PHP from source or lack vendor support.