server security

PHP vulnerabi

2026-10-22 02:20:10

Critical PHP flaws trigger emergency website shutdowns as patch race begins

Two critical PHP vulnerabilities with CVSS v4 scores of 9.2 have pushed governments, hosting operators, and security teams into emergency mode, with some public-facing websites temporarily taken offline before patches were broadly applied. The bugs allow unauthenticated remote code execution on affected servers, meaning attackers may be able to run malicious code without logging in, steal data, alter web pages, or fully take over a server. PHP has released fixes for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while also confirming that PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed are affected, with Apache mod_php carrying particularly high risk. The issue matters to crypto users even if blockchains themselves are untouched. A compromised server can serve a malicious front end that looks normal but tricks users into connecting wallets or approving token transfers. Cloudflare said it had already seen early attack activity before the official patch release and pushed emergency firewall rules to customers, though it described those protections as temporary. For site operators, the message from the PHP Foundation and core developers is blunt: patch or upgrade immediately. For users, the practical risk is not a PHP update on their own devices, but whether the websites they trust have secured their servers in time.

60

Tencent Cloud

2026-10-21 15:11:01

Tencent Cloud Security Center flags PHP remote code execution flaws

Tencent Cloud Security Center said PHP has disclosed remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, under the codename "php2shell." According to the alert, an unauthenticated remote attacker could send a specially crafted multipart POST request to trigger memory corruption and ultimately achieve remote code execution. The issue could lead to full server compromise and related security risks. Tencent Cloud Security Center advised users to carry out security checks as soon as possible and, if their systems fall within the affected scope, apply updates and fixes promptly to reduce the risk of intrusion by external attackers.

20

SlowMist

2026-10-21 02:25:48

SlowMist warns of two critical PHP RCE flaws as patch remains unavailable

SlowMist issued a security alert after PHP published a security notice on Oct. 20 disclosing two severe vulnerabilities that could lead to remote code execution. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both carry a CVSS v4 score of 9.2. PHP has not yet released a fix, and the affected versions as well as the exact exploitation conditions have not been confirmed. Based on currently available information, PHP plans to release a security update at 14:00 UTC on Oct. 21, which is 22:00 Beijing time. SlowMist urged relevant organizations to review PHP versions running on servers and business systems as soon as possible, with particular attention on internet-exposed PHP services. It also advised teams to apply the update promptly once the patch is available. For systems that cannot be upgraded immediately, SlowMist recommended restricting access sources and, if necessary, adopting isolation measures.

80