- Joined
- Threads
- 8
- Posts
- 9
Hello everyone,
Two new critical PHP vulnerabilities were disclosed on October 21, 2026, potentially allowing unauthenticated Remote Code Execution (RCE) on vulnerable servers.
These vulnerabilities are particularly concerning because they affect PHP itself rather than a specific CMS or web application.
Vulnerability Details
CVE IDs:
Severity: Critical (CVSS 9.2)
Type: Memory corruption / Use-After-Free
Impact: Unauthenticated Remote Code Execution
Affected Software: PHP
Why Is This Dangerous?
Under certain conditions, an attacker may be able to exploit these vulnerabilities remotely without valid login credentials.
Potential consequences include:
The vulnerabilities are especially concerning for internet-facing PHP installations.
Affected Environments
Potentially vulnerable deployments include:
Fixed PHP Versions
Administrators should update immediately because there are no complete alternative mitigations.
Discussion
I’m interested in hearing what the community thinks about these new vulnerabilities.
References
Official PHP advisory:
PHP Foundation:
Feel free to share your technical analysis, research, and findings.
Stay safe and keep your servers updated!
Two new critical PHP vulnerabilities were disclosed on October 21, 2026, potentially allowing unauthenticated Remote Code Execution (RCE) on vulnerable servers.
These vulnerabilities are particularly concerning because they affect PHP itself rather than a specific CMS or web application.
Vulnerability Details
CVE IDs:
- CVE-2026-109618
- CVE-2026-109619
Severity: Critical (CVSS 9.2)
Type: Memory corruption / Use-After-Free
Impact: Unauthenticated Remote Code Execution
Affected Software: PHP
Why Is This Dangerous?
Under certain conditions, an attacker may be able to exploit these vulnerabilities remotely without valid login credentials.
Potential consequences include:
- Remote execution of malicious code
- Complete compromise of vulnerable web applications
- Unauthorized server access
- Deployment of malicious PHP shells
- Data theft and server compromise
The vulnerabilities are especially concerning for internet-facing PHP installations.
Affected Environments
Potentially vulnerable deployments include:
- Apache with mod_php
- PHP-FPM
- PHP-CGI
- LiteSpeed
- FrankenPHP
Fixed PHP Versions
| PHP Branch | Patched Version |
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Administrators should update immediately because there are no complete alternative mitigations.
Discussion
I’m interested in hearing what the community thinks about these new vulnerabilities.
- How serious do you think these PHP RCE issues are?
- Have you reviewed the technical advisories?
- Which PHP server configurations are most exposed?
- What detection methods would you recommend?
- Could these vulnerabilities have a significant impact on shared hosting environments?
References
Official PHP advisory:
PHP Foundation:
Feel free to share your technical analysis, research, and findings.
Stay safe and keep your servers updated!
