The PHP security team warns that all users should perform an emergency security update of the system this Wednesday (21) due to serious flaws in versions of the programming language.
PHP is a server-side programming language used on the servers of many sites. According to the company, a vulnerability widened the risk that an attacker could execute code on the server without needing to log in, which could pave the way for data theft, page modification, malware installation, and compromise of other systems, depending on the server’s permissions and configuration.
The issue may lie in the PHP version that keeps sites running. A site may be running WordPress, for example, with plugins and themes updated, and still be vulnerable if the server is using a PHP version without the fix. Sites can go down, for example, if preventive measures are not taken.
Versions affected are those prior to the PHP fixes 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP version 8.1 and earlier no longer receive regular updates from the project and may also be affected.
What is the PHP vulnerability?
The PHP advisory describes two distinct vulnerabilities:
- CVE-2026-109618 — memory exhaustion corruption (OOM): when PHP runs out of memory during the processing of a request, it can enter an internally inconsistent state. In the cleanup phase, it may interpret partially initialized data as valid. According to the advisory, this could allow remote code execution;
- CVE-2026-109619 — obsolete global state: internal information of a request may remain in memory after it is released. A subsequent request, served by the same server process, may reuse those data inappropriately before the correct reset of the state.
Both issues are within PHP’s internal operation, with one involving an error during a memory shortage situation, while the other involves improper reuse of old information between requests.
The advisory indicates that they are at risk “all PHP installations that process web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk higher for mod_php, with a demonstrated exploit in which an unauthenticated request can trigger the attack even before any application code is executed.”
What to do to avoid the PHP flaw?
The main recommendation from the company is that all users with older language versions update their systems to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The source code is available on the PHP downloads page.
Given the severity of the identified vulnerabilities, the PHP security team has released minimal backports of the source code for versions 7.4, 8.0 and 8.1, aimed at assisting those who compile the software from source or who do not have access to a vendor with long-term support (LTS).
If it is not possible to perform the update immediately, the company’s site reveals some steps to follow that reduce exposure to specific attack vectors, though not making the installation fully secure.
