Skip to content
theregister·

🚨PHP Critical Vulnerabilities Require Immediate Updates

PHP sites at risk: update now or face downtime

TL;DR

PHP developers released emergency updates for two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Exploits are already in the wild, impacting sites like WordPress, Drupal, and Magento.

PHP developers have released emergency updates for two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These vulnerabilities can allow unauthenticated remote code execution, making them a high risk for any PHP installation serving web requests. The CERT-EU lists both vulnerabilities with CVSS scores of 9.2, indicating a severe threat. In-the-wild exploitation is already being observed, with proof-of-concept exploits detected. Sites running PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed are particularly at risk, especially mod_php, where a demonstrated exploit exists. Organizations like the Finnish government services and Dutch parliament have taken their websites offline as a precaution.

PHP Critical Vulnerabilities Require Immediate Updates — theregister

Key Points

1

PHP developers released emergency updates for two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

2

Exploits are already in the wild, impacting sites running PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed.

3

The CERT-EU lists both vulnerabilities with CVSS scores of 9.2, indicating a severe threat.

4

Organizations like the Finnish government services and Dutch parliament have taken their websites offline as a precaution.

5

The vulnerabilities affect shared hosting platforms, control panels, and software that runs PHP under the hood.

Why It Matters

If you're running WordPress, Drupal, Joomla, or Magento on PHP, this update is critical. The vulnerabilities (CVE-2026-109618, CVE-2026-109619) can allow unauthenticated remote code execution, making them a high risk for any PHP installation serving web requests. Exploits are already being detected, and the CERT-EU lists both with CVSS scores of 9.2. This update is not optional.

phpvulnerabilityupdatesecurityweb

Comments

Subscribe to join the conversation...

Be the first to comment

Enjoyed this article?

Get it daily. 7am. Free. Reads in 5 minutes.

Join 3,569 builders reading daily.

Also get