The UK's National Cyber Security Centre, along with EU and Australian counterparts, has told organisations using PHP to install a critical update released by the PHP Foundation on Wednesday. Two vulnerabilities were identified that could allow unauthenticated remote code execution, potentially letting attackers install malware or disable websites. Officials say affected versions may stretch back as far as PHP 5, released in 2004.
bbc.co.uk
· 2026-10-21
The PHP project has issued version 8.5.12 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let an attacker achieve unauthenticated remote code execution. One flaw stems from out-of-memory handling corrupting partially initialized request data, while the other involves stale internal state persisting across requests on the same worker. The advisory says all web-facing PHP setups are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php deemed highest risk since a working exploit can trigger before any application code runs.
techspot.com
· 2026-10-21
The PHP Foundation is rolling out patches for two vulnerabilities rated 9.2 out of 10 in severity, following reports of a tool called PHP2Shell that can run malicious code on servers using WordPress, Drupal, MediaWiki and other PHP-based platforms, reportedly affecting every PHP version since 2004. Separately, India-based certificate authority eMudhra disclosed that eight of its intermediate CA certificates—trusted by Mozilla, Microsoft, Apple and Chrome—have weak private keys that could let attackers forge credentials.
engadget.com
· 2026-10-21
The PHP security team issued emergency updates fixing two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, found by researchers from Calif, Wiz, and OpenAI. Both bugs stem from memory corruption when requests end abnormally and affect nearly all PHP deployments that handle web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with limited source backports offered for older 7.4, 8.0, and 8.1 branches.
bleepingcomputer.com
· 2026-10-21
PHP developers issued an advisory disclosing two vulnerabilities rated 9.2 out of 10 in severity, affecting every PHP version since PHP 5. A patch was expected to be released Tuesday at 10AM ET, with developers urging immediate upgrades once available, and some agencies suggesting affected systems go offline if patching isn't possible right away.
theverge.com
· 2026-10-21
PHP maintainers announced Monday that patches for two vulnerabilities, each rated 9.2 out of 10 in severity, would be released within about 12 hours. The advisory followed leaked, unconfirmed details of an exploit tool called PHP2Shell demonstrated against popular PHP-based platforms including WordPress, Magento, Drupal, and Joomla. Security firm watchTowr said the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, appear to affect every PHP version since PHP 5 in 2004 and that it has confirmed they are genuine.
arstechnica.com
· 2026-10-21
The PHP project announced an upcoming security release fixing two critical vulnerabilities, each rated 9.2 on the CVSS v4.0 scale. The patch is planned for Wednesday, 21 October 2026 at 14:00 UTC, with the PHP security team urging users to prepare in advance.
news-web.php.net
· 2026-10-20
The PHP security team announced it will ship fixes on Wednesday, October 21 at 14:00 UTC for two vulnerabilities each rated 9.2 on CVSS v4.0, after details reportedly leaked ahead of a planned embargoed disclosure. Researchers at watchTowr say the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs affecting PHP versions 5 through 8, and that watchTowr has reproduced one of them without releasing technical details.
bleepingcomputer.com
· 2026-10-20
Hackers have been exploiting a critical command injection vulnerability in Nextcloud's built-in Collabora Online CODE server app since at least September 10, weeks before the issue received a formal advisory and CVE number. The flaw lets unauthenticated attackers send a crafted request to the app's proxy.php endpoint and run system commands when the bundled CODE server is down, such as after a restart or crash, allowing them to plant PHP webshells and hunt for passwords and crypto wallets.
bleepingcomputer.com
· 2026-10-15
A new open-source project called Edi Life OS combines ten workspaces—including habit tracking, Kanban boards, a Pomodoro timer, finance tracking and goal planning—into a single self-hosted dashboard built on PHP and MySQL. The tool includes a built-in MCP server that lets AI assistants like Claude read dashboard data, plan goals, log habits and track expenses on the user's behalf.
github.com
· 2026-10-09
A solo developer built a game backend called GDT (Game Development Toolkit) that has run every title they've shipped since 2016, including Marooners, Verdun, Tannenberg, Isonzo, Crash Drive 2 and 3, plus a seventh game built by another studio. The PHP version, roughly 20,000 lines running on Google App Engine with Firestore, supported Steam, Epic, PlayStation, Xbox, Switch, mobile and web without a player-noticed outage in ten years, and has now been replaced by a C# version on Cloud Run.
m2h.nl
· 2026-09-22
A developer built Qbix, a PHP webserver that forks thousands of lightweight worker processes from a single parent process using pcntl_fork(), relying on the Linux kernel's copy-on-write memory sharing. Unlike FrankenPHP, RoadRunner or PHP-FPM, which are limited by worker count due to memory duplication, Qbix lets each worker share the framework's loaded classes and only pay memory costs for pages it actually modifies during a request.
qbixserver.com
· 2026-09-18
GoKawiil