PHP Official Urges Users to Update Immediately to Avoid Severe Remote Code Execution Vulnerabilities

Odaily Planet Daily News: The PHP official team has issued a security advisory regarding two previously disclosed severe remote code execution (RCE) vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Attackers may exploit these vulnerabilities to execute malicious code without authentication. PHP strongly recommends all users to upgrade immediately. These vulnerabilities affect PHP environments handling web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, with Apache mod_php being particularly at risk as attacks can be triggered before application code execution. The official team has released patched versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users still running PHP 8.1 or earlier versions should contact their distribution or long-term support (LTS) providers to confirm patch availability or upgrade to supported versions. The PHP team emphasizes that temporary mitigation measures cannot fully eliminate the risk, and installing security updates immediately is the only definitive solution to address the vulnerabilities.