{
  "id": 16507740,
  "title": "PHP Patches Two Critical RCE Flaws That Were Already Under Attack",
  "url": "https://urgent.news/2026/10/25/php-patches-two-critical-rce-flaws-that-were-already-under-attack",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-25T18:07:00.000Z",
  "source": {
    "name": "InfoQ",
    "slug": "infoq",
    "url": "https://www.infoq.com/news/2026/10/php-critical-rce-patches/"
  },
  "original_language": "en",
  "account": "On October 21, PHP released emergency updates to address two critical vulnerabilities that had already been exploited. The flaws, both rated 9.2 under CVSS v4.0, are known as CVE-2026-109618 and CVE-2026-109619. They represent memory-safety failures in the request lifecycle, with one occurring during out-of-memory handling and the other in state that outlives the memory backing it. Sansec reports that these vulnerabilities are present in every unpatched PHP version since 5.4.\n\nThe PHP Foundation disclosed the CVE identifiers two days early, which allowed a researcher to mistakenly publish a video showing a proof of concept. Chainguard also broke the embargo and published built images containing the fix, making it easy for attackers to study the fix in binary form while other PHP users waited for the release. Exploitation attempts were made as early as October 17, according to Amazon Threat Intelligence.\n\nApache mod_php and PHP-FPM were confirmed as susceptible to remote code execution, with the former validated over HTTP against mod_php with default PHP input and memory limits. FrankenPHP may also be at risk. Attackers found it difficult to identify if PHP was running at all, as it could be behind various home server software such as OPNsense, OpenMediaVault, Nextcloud, and Coolify.\n\nDebian Trixie released updates quickly, while Ubuntu, Red Hat, and official Docker images lagged behind. Ubuntu's security team published their fix thirteen minutes after disclosure, leaving Ubuntu 24.04 users with a fixed package that still reported the outdated version. Many distro builds and container images still contained the vulnerable code.\n\nThe PHP Foundation acknowledges that security work on PHP still depends on a small group of foundation-funded developers, resulting in an upgrade gap for PHP 8.1 and older versions. PHP advises setting session.upload_progress.enabled=0 until the next bugfix release to mitigate the risk of further exploitation.",
  "summary": "PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities allowing unauthenticated remote code execution. Amazon recorded an exploitation attempt four days before the patches shipped, and operators spent the day working out whether they ran PHP, where to get the package, and how to tell it had landed. By Steef-Jan Wiggers",
  "key_points": [
    "PHP releases emergency updates to patch two critical RCE flaws",
    "Vulnerabilities CVE-2026-109618 and CVE-2026-109619 already under attack",
    "Many distro builds and container images still contain vulnerable code"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}