PHP releases emergency fixes as some of the world's biggest websites say they were targeted by hackers
- PHP released fixes for two critical remote code execution flaws and urged immediate patching
- Security researchers and Cloudflare reported early exploitation attempts before patches became available
- Millions of internet-facing PHP installations may be at risk, especially unsupported legacy versions
PHP has released patches for two critical remote code execution (RCE) vulnerabilities and “strongly encouraged” all users to apply them as soon as possible, as hackers are starting to abuse the flaws in real-life attacks.
PHP issued a new security advisory saying it addressed CVE-2026-109618 and CVE-2026-109619 with a patch. The former is an out-of-memory handling bug, while the latter is a use-after-free memory error. Both were assigned a severity score of 9.2/10 (critical).
The vulnerabilities were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can download the versions from PHP’s downloads pages, with Windows source and binaries being on the same page. Linux distributions and LTS vendors received...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
