Cybersecurity agencies pressed website operators to secure PHP systems on October 22, extending a global response to two critical software flaws. New Zealand's National Cyber Security Centre urged immediate patching and monitoring for exploitation. The warning followed emergency fixes released on October 21 for vulnerabilities that can let an attacker run code on a server without logging in.
The PHP project's advisory identifies all installations handling web requests as at risk, including PHP-FPM and Apache with mod_php. It considers the risk highest for mod_php, where researchers demonstrated an attack before application code runs. PHP generates web pages and handles server-side tasks; exposure therefore depends on the software and configuration behind a service.
The project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Its advisory describes problems in memory management and internal state left behind between requests. Operators using packages supplied by operating-system distributors or long-term support vendors should consult those suppliers for corrected builds, the project said.
The PHP Foundation said the first signs of one problem emerged during work following a 2024 security audit. Later reports from Calif, OpenAI and Wiz established its full impact, making a fix the foundation's top security priority in August. The foundation acknowledged that limited resources and difficulty choosing a compatible repair had delayed earlier work, and said it was changing its decision-making processes.
Britain's National Cyber Security Centre urged organisations to identify PHP across their infrastructure, prioritising systems exposed to the internet. Its guidance says operators unable to update or apply temporary mitigations promptly should consider taking systems offline. Such precautions address exposure; an outage alone does not establish that attackers have compromised a website.
New Zealand's agency warned that patching does not undo an existing compromise. Britain's guidance likewise calls for checks for evidence of intrusion and attacker-installed backdoors where immediate updating or shutdown is impossible. Both advisories make continued monitoring part of the response, while the British agency also urges attention to updates for third-party products and services that include PHP.
Comments