Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code execution (RCE).
On Wednesday morning, the PHP Foundation released patches for affected versions, and said it is “imperative” that organizations running PHP patch immediately. It said that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where an unauthenticated request can trigger exploitation before application code runs.
In response to the disclosures, some government websites in Europe, including those in the Netherlands and Finland, as well as those of other organizations worldwide, went offline as a precautionary measure.
PHP is ‘the web itself’
PHP is a widely-used, open source server-side scripting language that underlies websites like WordPress, which powers 43% of the web, as well as Mailchimp, Drupal, Magento, Laravel, and parts of Slack and Zoom, and numerous others.
The impact is not limited to websites, noted the Netherlands National Cyber Security Centre (NCSC-NL) in its description of the flaws, collectively dubbed PHP2Shell. PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly. And CERT-EU, an organization that tracks cybersecurity threats in the European Union, also warned that many commercial and open-source products use PHP as a backend technology, and these could be also impacted by the flaws, even if they do not directly expose a PHP installation.
This makes the vulnerabilities all the more serious. CVE-2026-109618, which has a 9.2 severity rating on the common vulnerability and scoring system (CVSS), could allow RCE via memory corruption during out-of-memory handling (OOM), a strategy that operating systems (OSes) and apps use when physical RAM and swap spaces become exhausted.
CVE-2026-109619, also with a score of 9.2, remote code execution via stale request-owned global state reused by a later request on the same worker.
Both flaws sit in parts of PHP that nearly every request touches: Memory management and error handling, the PHP Foundation noted. This makes both bugs extremely serious, and also difficult to fix without impacting compatibility or performance. Organizations should begin with the assumption that they are exposed.
“What makes these vulnerabilities significant is where they sit,” said Forrester senior analyst Madelein van der Hout. PHP underpins 70% of websites, making this a huge concentration risk.
“Checking the corporate website alone is not enough,” she said. “Organizations need to establish where they are exposed and prioritize internet-facing systems.”
Affected organizations should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux and long-term support (LTS) vendors received patches in advance, the Foundation said, so organizations should check with their vendors about fixes.
PHP 8.1 and other end of life versions no longer receive updates from the PHP project, although some distributors and LTS vendors provide backported fixes, so organizations still running unsupported versions should also check with their vendor.
Those relying on the volunteer-maintained rpms.remirepo.net should switch distribution packages or build from source to immediately apply updates, the PHP Foundation advised.
Those unable to patch immediately should take the preventive action it described to reduce exposure, CERT-EU said, warning that these mitigations do not make an installation safe.
“This is what an internet-scale vulnerability looks like,” said Neatsun Ziv, CEO of runtime app security company OX Security. “When a flaw hits technology this ubiquitous, the blast radius isn’t one product or one industry. It’s the web itself.”
Researchers from his company independently reproduced the flaws and found that the vulnerable functionality is enabled by default, and has existed in PHP since version 5.4.
Still, experts emphasize that patching is just one element of response. Speed matters, Forrester’s van der Hout noted, and security teams need to identify everywhere PHP is running, prioritize exposed systems, apply the official fixes promptly and investigate for signs of compromise.
“A patch fixes the vulnerability; it does not necessarily remove access an attacker may already have established,” she said.
Offline does not mean hacked
With rumors of exploits already available on the dark web, taking services down to protect and then patch them is a pragmatic choice, experts say.
Forrester’s van der Hout emphasized that taking a website offline does not mean it has been hacked. If an organization cannot yet
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article:
Two critical PHP flaws put the web on alert as emergency patches arrive