Particle.news
Get it on Google Play
Download on the App Store
6 ARTICLES
·
8h ago

PHP Patches Two Critical Flaws That Let Attackers Run Code Remotely

Security updates were published to stop vulnerabilities that could let unauthenticated attackers fully compromise web servers.

La alerta de seguridad llevó a distintas organizaciones a suspender temporalmente el acceso público a sus páginas mientras preparaban la actualización de sus sistemas. La medida buscaba reducir el riesgo de intrusiones antes de instalar los parches. Foto: Pexels.
Image
Sitios de todo el mundo se cayeron por fallas de seguridad

Overview

  • The PHP project published corrective releases for supported branches on Wednesday, issuing PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619.
  • Both flaws allow unauthenticated remote code execution on vulnerable servers and are described as a memory exhaustion issue and a use-after-free that can expose internal data left in freed memory.
  • Security firms said AI tools were used in the discovery process and that the vulnerability details were disclosed privately to PHP maintainers before a leak surfaced online one day ahead of the planned release.
  • National cybersecurity authorities urged immediate patching or temporary takedowns, and several governments and public services in the Netherlands, Finland and France disconnected sites as a precaution.
  • PHP warns there is no full workaround so administrators must install the updates or take services offline until patched, and sites on shared hosting or near‑EOL PHP versions should coordinate with hosts and plan upgrades.