Particle.news
Get it on Google Play
Download on the App Store
28 ARTICLES
·
59m ago

Critical PHP Flaws Trigger Global Patch Rush

Two memory-management bugs allow unauthenticated code execution or data leakage, making immediate global patching necessary.

El sitio web de The PHP Foundation se ha actualizado a la versión más reciente de PHP. Una vulnerabilidad de seguridad grave, recién descubierta, está comprometiendo los cimientos de numerosos sitios web y servicios en línea en todo el mundo
La alerta de seguridad llevó a distintas organizaciones a suspender temporalmente el acceso público a sus páginas mientras preparaban la actualización de sus sistemas. La medida buscaba reducir el riesgo de intrusiones antes de instalar los parches. Foto: Pexels.
1. Qué pasó con las páginas web de varios gobiernos y cuál es el riesgo de las fallas en PHP.
Alerta informática en la UB.

Overview

  • Security teams privately flagged the flaws in August and a public leak on October 20–21 forced PHP maintainers to publish emergency fixes identified as CVE-2026-109618 and CVE-2026-109619.
  • The two bugs score 9.2 on CVSS 4.0 and stem from PHP memory handling: one uses uninitialized memory and the other keeps freed data available, which can enable remote code execution or expose sensitive server memory.
  • National agencies including the U.S. NSA, CERT-EU and the UK NCSC urged immediate updates or isolation of vulnerable systems, and many governments and major sites temporarily took services offline while applying patches.
  • Security firms report the flaws were found and analyzed with AI tools and warn that the same AI methods can speed creation of exploit code; cloud providers and vendors are coordinating mitigations as scanning and limited probes have been detected.
  • Smaller sites and shared hosting are most at risk because automatic updates may not apply, so administrators must manually patch, upgrade unsupported PHP installations, or take services offline until they confirm protection.