PHP flaws trigger global cyber alert
Two serious flaws in PHP, a programming language powering much of the internet, could allow hackers to run their own code on remote servers without logging in. These vulnerabilities, collectively named PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, each scored a 9.2 on the CVSS v4.0 scale, making them critical. PHP has released patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but many servers remain unpatched or unsupported.
On October 23, PHP advised users to disable its session upload progress feature to mitigate a third, narrower flaw.
PHP powers platforms like WordPress, Drupal, Joomla, and Magento, and security researchers warn that companies may be exposed through commercial applications, hosting providers, and embedded software. Censys counted around 36.7 million internet-facing services with potentially affected PHP versions in its October 22 snapshot, while Qualys found 167 million PHP package installations across 12,000 organizations, with 73 percent on internet-facing assets.
CVE-2026-109618 is activated when a request makes PHP run out of memory, and CVE-2026-109619 involves internal request data surviving after memory has been freed. These flaws exist within PHP itself, not specific apps or plugins, so even well-coded sites can be exposed. According to PHP, all unpatched installations handling web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The Canadian Centre for Cyber Security considers the risk greatest for mod_php, as a demonstrated exploit allows unauthenticated requests to trigger the flaw before the application's code executes.
Written by urgent.news from The Economic Times's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
