PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address CVE-2026-109618 and CVE-2026-109619, which enable unauthenticated remote code execution across all deployments (PHP-FPM, mod_php, Apache, LiteSpeed, etc.). Threat intelligence firms have already observed exploitation attempts in the wild. CERT-EU recommends organizations patch immediately or isolate internet-facing applications from public networks until fixes are deployed. The mod_php deployment is considered highest risk.
Key points
- Two critical RCE vulnerabilities affect all PHP versions
- CVSS scores of 9.2; active exploitation observed
- Emergency patches released; immediate patching strongly urged
- mod_php considered highest risk; isolation recommended if patching delayed
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
