PHP released fixes for four supported versions Oct. 21 to address two critical vulnerabilities that could let attackers execute code remotely without logging in, while also publishing patches for three older branches.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each scored 9.2 under version 4.0 of the Common Vulnerability Scoring System (CVSS). PHP urged users to install the updates promptly in an online statement, DW reported.
Security firms Calif and Wiz alerted PHP developers to the vulnerabilities in August, DW reported. The development team kept details confidential while preparing fixes, but information became public Oct. 20, a day before the planned release, the outlet said. DW also reported that Cloudflare Chief Technology Officer Dane Knecht said attackers were already attempting to exploit the flaws.
Some European authorities took websites offline before the updates were available, according to DW. Germany's government IT service took down some sites using PHP, while Belgium's Foreign Ministry temporarily blocked its online presence. In France, the Paris Police Prefecture's website and local government pages went offline after a critical vulnerability was detected.
PHP no longer provides routine security updates for version 8.1 and earlier. For these vulnerabilities, its security team published limited source patches for versions 7.4, 8.0 and 8.1 as an exception to that policy. Some distributions and long-term support providers also supply backported fixes for older releases. EconoTimes' earlier report on source patches for older PHP versions covers those options. PHP security support for version 8.2 is scheduled to end Dec. 31, 2026.
