Particle.news
Get it on Google Play
Download on the App Store
191 ARTICLES
·
2h ago

PHP Emergency Patches Released After Two Critical Remote‑Code Flaws

The flaws let unauthenticated attackers run code or read server memory, forcing providers, vendors, governments to deploy emergency fixes or isolate affected sites.

Image
Image
Hard disk drives at the computer server, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany, October 21, 2026. REUTERS/Annegret Hilse
Government websites across Europe went dark on Wednesday as operators raced to patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web

Overview

  • Security teams rated two PHP bugs CVE-2026-109618 and CVE-2026-109619 at 9.2 and said they can allow unauthenticated remote code execution and the exposure of sensitive server memory.
  • PHP's maintainers issued emergency updates on Wednesday that fix supported branches including 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and published source patches for some older lines.
  • Cloudflare, Amazon and other firms reported exploit attempts before public disclosure and then large-scale automated attacks after the fixes were posted, with Cloudflare saying attempts rose into the millions.
  • National cyber agencies including CERT-EU, CISA, the NSA and the FBI urged immediate patching and recommended taking internet-facing PHP sites offline when timely updates are not possible.
  • Researchers say advanced AI tools helped find the flaws, speeding discovery and remediation while raising concern that the same tools can shorten the time from disclosure to usable exploits, and many legacy or embedded PHP installs still need vendor backports to be safe.