{
  "id": 15920292,
  "title": "PSA: PHP patches two critical flaws, server admins urged to update",
  "url": "https://urgent.news/2026/10/21/psa-php-patches-two-critical-flaws-server-admins-urged-to-update",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T17:09:00.000Z",
  "source": {
    "name": "TechSpot",
    "slug": "techspot",
    "url": "https://www.techspot.com/downloads/5680-php.html"
  },
  "original_language": "en",
  "account": "PHP, a widely-used open-source server-side scripting language, has released PHP 8.5.12 to patch two critical vulnerabilities that could allow unauthenticated remote code execution. The PHP development team strongly urges all PHP users, including those utilizing PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, to update their systems immediately.\n\nTwo critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) have been identified that can be exploited without any authentication. These vulnerabilities can trigger an attack before any application code runs, posing a significant risk. The risk is considered highest for systems using mod_php, as demonstrated by a proven exploit.\n\nThere are no complete mitigations available other than updating to PHP 8.5.12. The PHP development team has emphasized that updating is the only safe choice to protect against these vulnerabilities. All PHP 8.5 users are strongly encouraged to take immediate action to ensure their systems are secure.",
  "summary": "PHP has released emergency security updates addressing two critical vulnerabilities that could allow attackers to remotely execute code without authentication. With PHP powering nearly 70% of all websites, the potential impact is enormous. Apache deployments are particularly vulnerable, and security agencies are urging immediate updates. Read Entire Article",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "LWN",
        "title": "PHP patches released for two critical RCEs",
        "url": "https://urgent.news/2026/10/21/php-patches-released-for-two-critical-rces",
        "published": "2026-10-21T13:53:18.000Z"
      },
      {
        "outlet": "TechSpot",
        "title": "Two web emergencies in one week: guessable certificate keys and critical PHP bugs that leaked before patches",
        "url": "https://urgent.news/2026/10/21/two-web-emergencies-in-one-week-guessable-certificate-keys-and",
        "published": "2026-10-21T18:34:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}