PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
Websites down as precaution as exploits have already been published
PHP developers have unveiled urgent patches for two grave vulnerabilities after authorities urged swift remediation or suggested shutting down compromised applications. Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 of the PHP programming language address CVE-2026-109618 and CVE-2026-109619, which could permit unauthorized remote code execution.
Developers strongly advised users to apply the updates immediately, warning that all PHP installations handling web traffic could be susceptible, including setups with PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Jake Knott, head of threat intelligence at watchTowr, noted the gravity of the situation, stating that the organization has already detected exploitations of the latest PHP vulnerabilities in the wild. WatchTowr has observed various proof-of-concepts (PoCs) designed to execute malicious code ("php2shell" User-Agent strings) targeting exposed PHP applications. As of now, no successful attacks have been reported, but this scenario is expected to change rapidly.
In an advisory, CERT-EU recommended that organizations unable to patch PHP applications immediately should isolate internet-facing services from public networks until the vulnerabilities are remedied. The vulnerabilities, both rated 9.2 on the CVSS scale, were highlighted in the advisory. Notable entities, including Finnish government services and the Dutch parliament's websites, were taken offline as a precautionary measure. Privacy advocacy group noyb also briefly disabled its website.
PHP, the backbone of numerous popular content management systems and platforms like WordPress, Drupal, Joomla, and Magento, as well as shared hosting environments and control panels, poses a significant challenge for security teams. Identifying and addressing vulnerable installations across diverse systems is a complex and extensive task. John Hammond, senior principal security researcher at Huntress, emphasized the breadth of affected installations, pointing out the difficulty in pinpointing every vulnerable PHP version.
The widespread nature of PHP's usage across various systems, from standalone applications to integrated services, underscores the critical importance of addressing these vulnerabilities promptly. The rapid development and deployment of exploits highlight the need for robust security practices and timely patch management across all PHP-based systems.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
