PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched

PHP development teams have issued urgent updates to address two critical vulnerabilities, urging site owners to take their applications offline if they remain unpatched. The PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 versions now tackle CVE-2026-109618 and CVE-2026-109619, which could enable unauthenticated remote code execution. Developers have been pushing for prompt updates across all PHP installations, including those utilizing PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Jake Knott, head of threat intelligence at watchTowr, warned that the risk is particularly high for mod_php, as a demonstrated exploit allows unauthenticated requests to trigger the attack before any application code runs. WatchTowr Intel has already observed in-the-wild exploitation of the latest PHP vulnerabilities, with various "php2shell" User-Agents being utilized.

While no successful attacks have been recorded, experts expect this situation to change soon. Organizations that cannot promptly apply the patches are advised to isolate internet-facing applications from public networks until a fix is available, according to CERT-EU. Both vulnerabilities have been assigned a CVSS score of 9.2. Notable entities like Finnish government services, the Dutch parliament's websites, cybersecurity authorities, and data protection regulators have taken precautionary measures by temporarily taking their sites offline.

Privacy group noyb also suspended its website temporarily. PHP powers a wide range of software, making it essential to identify vulnerable installations, a task that can be quite extensive. Huntress, an infosec vendor, highlighted the challenge of identifying PHP-powered websites among various platforms. Senior principal security researcher John Hammond emphasized the complexity of the situation, stating that identifying vulnerable PHP versions across all relevant software can be quite daunting.