The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
- Published
- Record updated
Summary
Two critical memory-safety flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (both CVSS v4.0 9.2), can let unauthenticated attackers execute code on web servers. PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, and Cloudflare reports attack traffic already observed. The NSA and CERT-EU advised taking unpatched internet-facing PHP applications offline or isolating them from public networks.
Mitigation
Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Where patching is not immediately possible, the source says the NSA recommended taking affected systems offline until fully mitigated, and CERT-EU urged isolating applications from public networks.