PSA: PHP patches two critical flaws, server admins urged to update
PHP has released emergency security updates addressing two critical vulnerabilities that could allow attackers to remotely execute code without authentication. With PHP powering nearly 70% of all websites, the potential impact is enormous. Apache deployments are particularly vulnerable, and security agencies are urging immediate updates. Read Entire Article
PHP, a widely-used open-source server-side scripting language, has released PHP 8.5.12 to patch two critical vulnerabilities that could allow unauthenticated remote code execution. The PHP development team strongly urges all PHP users, including those utilizing PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, to update their systems immediately.
Two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) have been identified that can be exploited without any authentication. These vulnerabilities can trigger an attack before any application code runs, posing a significant risk. The risk is considered highest for systems using mod_php, as demonstrated by a proven exploit.
There are no complete mitigations available other than updating to PHP 8.5.12. The PHP development team has emphasized that updating is the only safe choice to protect against these vulnerabilities. All PHP 8.5 users are strongly encouraged to take immediate action to ensure their systems are secure.
Written by urgent.news from TechSpot's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
