PHP has issued a security advisory urging users to update immediately after the disclosure of two severe remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. The project said attackers may be able to execute malicious code without authentication. Affected environments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, all of which handle web requests. PHP said the risk is especially serious for Apache mod_php because exploitation can be triggered before application code runs. The project has released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Users still running PHP 8.1 or earlier were told to check with their distribution or long-term support provider for patch status, or move to a supported release. PHP also said temporary mitigations do not fully remove the risk, and that installing the security updates is the only complete fix.
PHP has published a security advisory for two previously disclosed remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and urged all users to upgrade immediately.
According to the advisory, attackers may be able to exploit the flaws without authentication to execute malicious code. The issue affects PHP environments that process web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP said Apache mod_php faces especially high risk because an attack can be triggered before application code runs.
Patched releases are now available
PHP has released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Users still on PHP 8.1 and earlier versions were advised to contact their distribution or long-term support, or LTS, provider to confirm patch availability, or upgrade to a supported version.
PHP added that temporary mitigation measures cannot fully eliminate the risk, and said installing the security updates is the only complete remedy.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
