PHP maintainers urge updates after critical web server flaws

PHP maintainers released security updates on 21 October for two critical vulnerabilities that can allow an unauthenticated attacker to execute code remotely. The issues, tracked as CVE-2026-109618 and CVE-2026-109619, affect installations serving web requests. The PHP project says administrators should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, as appropriate for their branch. Its advisory says there are no complete mitigations and identifies the highest risk in Apache mod_php deployments, where a demonstrated exploit can be triggered before application code runs.

The advisory lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among configurations serving web requests. Operators should identify the versions they run, apply the appropriate vendor-supported fix, and check their hosting provider’s guidance where packages are maintained downstream. OpenAI said it coordinated research and disclosure with maintainers and security providers, while Wiz independently discovered and reported both vulnerabilities. The fixes were led by PHP maintainers. A patched package addresses the known flaws; organizations should still investigate signs of compromise where exposure is suspected.