{
  "id": 16149858,
  "title": "PHP Ships Fixes for Two Critical Unauthenticated-RCE Flaws",
  "url": "https://urgent.news/2026/10/23/php-ships-fixes-for-two-critical-unauthenticated-rce-flaws",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T04:22:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/techpulse01239/php-ships-fixes-for-two-critical-unauthenticated-rce-flaws-4o3h"
  },
  "original_language": "en",
  "account": "PHP has released updates for four versions to patch two critical remote code execution flaws. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are rated with a CVSS v4.0 score of 9.2. They can potentially allow unauthenticated remote code execution in PHP installations serving web requests, with Apache’s mod_php configuration being the most at risk. The issues involve out-of-memory handling and request-owned global state remaining after being freed. PHP asserts these flaws can be exploited before application code runs under mod_php. An external audit and subsequent work by AI-assisted tools and human reviewers helped clarify the impact of the out-of-memory flaw. Despite no confirmed exploit at the time of release, several organizations took precautionary measures, including shutting down public-facing services in multiple countries. Public-facing services in the Netherlands, Finland, Denmark, and France were offline or in preventive maintenance mode. Approximately 1.5 million of the 2.6 million hosts reported were out of date, though this does not guarantee all were vulnerable or compromised. PHP advises updating as the definitive solution, with older versions no longer receiving support.",
  "summary": "The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21 to address CVE-2026-109618 and CVE-2026-109619. PHP rates both flaws CVSS v4.0 9.2 and says they can allow unauthenticated remote code execution. The project warns that PHP installations serving web requests may be affected, with the highest risk in Apache’s mod_php configuration. [1] The first issue is an…",
  "key_points": [
    "PHP releases patches for two critical unauthenticated RCE flaws",
    "CVE-2026-109618 and CVE-2026-109619 vulnerabilities rated 9.2",
    "Public-facing services in Netherlands, Finland, Denmark, France affected"
  ],
  "editors_take": "The severity of these unauthenticated flaws forces immediate patching across global web infrastructure to prevent attackers from executing code before application security measures can even initialize.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}