Emergency Patches Released for Critical PHP Security Vulnerabilities

Developers behind the PHP programming language released emergency security updates on Wednesday to address two critical vulnerabilities impacting web servers worldwide. The flaws, designated as CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10 on the Common Vulnerability Scoring System. Cybersecurity authorities across the globe immediately urged organizations to apply the patches or take vulnerable internet-facing systems offline to prevent potential remote code execution attacks.

The vulnerabilities affect PHP installations processing web requests, with historical roots tracing back to older software versions. According to the PHP Foundation, the security issues stem from memory handling flaws. The first vulnerability triggers an out-of-memory condition that causes PHP to treat partially initialized request data as valid. The second flaw allows internal state data from previous requests to persist in memory and potentially impact subsequent requests handled by the same worker.

Security experts warn that these weaknesses could allow unauthenticated attackers to execute arbitrary commands, steal sensitive process memory, or fully take over affected web servers. Independent security consultant Lukasz Olejnik described the situation as critical infrastructure risk, noting that millions of systems utilizing PHP for backend application logic, content management systems, and e-commerce platforms could be vulnerable. Cloudflare reported observing early attack vectors emerging even before official software details and patches were fully published.

In response to the imminent threat, governments and cybersecurity organizations took proactive measures. State web services and parliamentary portals in countries including Finland, the Netherlands, and France were temporarily taken offline as a precaution. In Latvia, cyber incident response authority CERT.LV implemented selective access restrictions to limit foreign traffic to public digital services while safety updates were deployed. Agencies in the United Kingdom, Australia, and the European Union issued similar warnings, advising organizations to isolate internet-facing applications if immediate patching was unfeasible.

The PHP security team published updated software versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to permanently resolve the issues. While ongoing official updates are limited to supported versions 8.2 and newer, the PHP Foundation and third-party vendors also provided limited source-code fixes for older installations like PHP 7.4, 8.0, and 8.1. Security professionals emphasize that applying web application firewalls or temporary mitigations acts only as a stopgap measure, and updating the underlying software remains the only complete protection.

Website owners and system administrators are advised to immediately verify their PHP versions, coordinate with web hosting providers to ensure patches are correctly installed, and check server configurations. Experts also recommend auditing infrastructure for potential prior compromises, web shells, or unauthorized file alterations, as emergency patches cannot remove malicious access that was established before the update was applied.