Particle.news
Get it on Google Play
Download on the App Store
227 ARTICLES
·
3h ago

PHP Emergency Patches Released as Mass Scanning and Exploits Escalate

The two critical memory-corruption flaws let unauthenticated attackers run code on many web servers, prompting urgent global patching and temporary shutdowns of exposed sites.

Image
FILE - An FBI seal is displayed on a podium before a news conference at the field office in Portland, Ore., Jan. 16, 2025. (AP Photo/Jenny Kane, File)
Image
Hard disk drives at the computer server, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany, October 21, 2026. REUTERS/Annegret Hilse

Overview

  • The PHP project published emergency updates on Wednesday to fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2, and advised operators to install the new PHP 8.2–8.5 releases or check vendor backports for older builds.
  • National cyber agencies including the NSA, CISA and CERT‑EU urged organizations that cannot apply fixes immediately to take public-facing PHP services offline to block remote code execution risks.
  • Researchers said advanced AI tools helped find and reproduce the bugs, which are memory‑corruption errors that in some setups—notably Apache with mod_php—can be triggered before a site’s own code runs.
  • Cloudflare, Amazon and other defenders reported thousands then millions of probes and exploit attempts within hours of disclosure, and multiple governments and major sites briefly went offline while teams patched.
  • Full remediation remains difficult because PHP is widely embedded, many legacy or bundled installs need vendor backports, and operators must inventory hidden PHP instances to prevent follow‑on compromises.