Tonight, the internet goes into meltdown. A critical PHP vulnerability was published earlier today, giving remote attackers a full way to run code on your server if you don’t patch.
Updates have been released for PHP 8.2, 8.3, 8.4 and 8.5 today under CVE-2026-109618 and CVE-2026-109619.
PHP has released the fixes. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. PHP's security advisory calls updating "the only safe choice" and says the risk is highest for Apache with mod_php. The two bugs are CVE-2026-109618 (corruption after an out-of-memory error during a request) and CVE-2026-109619 (state from one request surviving into the next).
Updates have been released for a lot of systems and servers, make sure you get patched up.
Be First to Comment