PHP Foundation Issues Urgent Security Updates for Critical Vulnerabilities

The PHP Foundation has disclosed two critical vulnerabilities that pose a significant threat to millions of websites. Security experts are warning that failure to promptly patch these flaws could lead to severe consequences.

On October 20, the developers of the widely used PHP programming language released emergency security updates to address these vulnerabilities, which could allow attackers to gain remote control of affected systems. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, impact all PHP installations serving web requests dating back to version 5, released in July 2004. However, only PHP versions 8.2 and newer are still supported and will receive patches, while some legacy fixes may be available from third-party vendors.

The PHP Foundation emphasized that there are no complete mitigations for these vulnerabilities, stating, “updating is the only safe choice.” Security experts warn that overlooking unpatched systems could lead to dire consequences.

Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King’s College London, remarked, “This is not a drill.” He highlighted the critical role PHP plays in web development, being integral to various platforms, including WordPress and Magento. Olejnik noted that the impact of these vulnerabilities could be enormous, potentially affecting millions of systems.

Concerns are mounting that malicious hackers could exploit these vulnerabilities before they are patched. Cloudflare reported observing early attacks emerging even before the PHP Foundation released details about the vulnerabilities and their fixes. Security firm Sansec warned that mass attacks could begin shortly after the release of the updates.

Davi Ottenheimer, a security and compliance consultant, described the vulnerabilities as akin to a front door without a lock, allowing attackers to exploit any server they can find without needing specific knowledge about the site or software.

In anticipation of the updates, some organizations took precautionary measures by taking their websites offline. Reports indicated that multiple Finnish government sites, including the National Land Survey, were inaccessible, along with French government websites and the Port of Rotterdam’s site.

Olejnik urged immediate patching, stating that exploitation could occur rapidly and at a large scale, especially with the aid of AI tools. Security company Wiz, owned by Google, claimed its researchers discovered the vulnerabilities in part using AI, while OpenAI and security firm Calif also reported independent discoveries of the issues.

The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or access sensitive process memory, which may contain passwords and authentication tokens. The PHP Foundation first alerted users to the vulnerabilities on October 20, noting that both flaws received a critical score of 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS).

In a previous warning, the PHP Foundation indicated that it would release patches earlier if evidence of active exploitation emerged. Reports suggested that some details about the vulnerabilities may have leaked before the official announcement.

The early warning from the PHP Foundation may have allowed some developers and security teams to prepare for updates. The EU’s Computer Emergency Response Team (EU-CERT) and Australia’s cybersecurity agency advised IT teams to be ready to update their systems promptly. The UK’s National Cyber Security Center (NCSC) also published an alert urging organizations to prepare for immediate updates and consider taking systems offline if remediation was not feasible.

The NCSC recommended that organizations identify systems running PHP and monitor them for potential exploitation. The next step involves applying PHP updates as they become available and staying alert for updates from software companies that may utilize PHP in their applications.

Brett Leatherman, the FBI’s cyber assistant director, advised that if signs of compromise are detected, organizations should isolate the affected systems and preserve logs for investigation.

Source: WIRED