PHP ( Personal Home Page first and now PHP: Hypertext Preprocessor ) is one of the most famous server side scripting language since 1995 for web application developers and was/is one of the favorite of many because of its open source nature.
Recently AI dicovered critical vulnerabilities in PHP affecting 70% of the Internet.
These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk.
Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.
Even NSA addressed the issue in following words
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.
The Vulenrabilities fixed in security update are
- CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
References :
#PHP #PhpVulnerabilities #PhpVulnerable #PhpSecurityPatch #PhpPatch