PHP released emergency updates for two high-severity vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, impacting PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Upgrades are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Which systems and versions are affected?
The issues were addressed in the new releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The issue affects PHP installations that handle web requests, including tools and configurations such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The biggest risk is found in the Apache mod_php setting, as it allows requests from unknown users to trigger attacks before the application code is even executed.
How problems work
The first problem is related to memory management when available space is exhausted and internal structures are half-built. The second problem concerns data from previous requests that remain in memory and are freed while references to them are still available.
READ ALSO
Serious PHP security flaws threaten millions of websites worldwide
Exploiting these vulnerabilities does not require a vulnerable PHP application or the ability to upload files, as the issues stem from the internal way PHP processes requests.
Distribution reaction and instructions
Various communities and operating system maintainers quickly mobilized to provide fixes. Debian announced updates for Debian 13 Trixie and Debian 12 Bookworm. Arch Linux warned maintainers to update immediately, while the AlmaLinux team approved the release of fixes earlier than other related distributions.
Older versions of PHP 8.1 are no longer supported, while version 8.2 is approaching the end of support on December 31, 2026. There are no full workarounds to work around the issue, although limiting request sizes and disabling specific upload settings can slightly reduce exposure.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)