PHP flaws let attackers run code on web servers without a login
- Affected
- PHP before
8.5.12,8.4.27,8.3.36and8.2.35, plus PHP 8.1 and older, which get no releases. All versions and fixes
- CVE
- Vendor
- PHP
Two flaws in PHP itself, and , let an unauthenticated attacker run code on servers that use PHP to handle web requests, PHP says. It released fixes for its four supported branches on Oct 21 and says only an update fully fixes them. Cloudflare and Arctic Wolf say they have seen exploitation attempts, and Arctic Wolf saw attempts to download malware.
PHP says lets its out-of-memory handling stop a request while internal data is only partly set up, so the cleanup that follows may treat that data as valid. In , state that belongs to one request can outlive its memory, and a later request on the same worker may use it. Wiz, which found the flaws with OpenAI and Calif, says the two IDs cover four bugs. It says attackers can also read process memory holding passwords, tokens and API keys without running code.
PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where its demonstrated exploit runs before any application code. Wiz says nearly every PHP release back to 5.4 has at least one of the flaws. Unit 42 counts more than 22.6 million exposed instances that may be vulnerable.
Details leaked on Oct 20, before the planned disclosure, Arctic Wolf says. Cloudflare says it saw attack traffic aimed at its customers, and attackers changing their payloads to get past its firewall rules. Arctic Wolf saw exploitation attempts that used wget to fetch ELF and Go binaries tied to commodity malware. Neither says an attempt succeeded. Cisco Talos and Canada’s Cyber Centre hadn’t seen exploitation when they wrote on Oct 21.
PHP 8.1 and older no longer get releases. PHP’s security team published minimal source backports for 7.4, 8.0 and 8.1, and Linux distributions received the patches in advance. PHP lists settings that block some attack paths, but says they don’t make an installation safe. Cloudflare says its firewall rules protect customers by default, and still advises patching.
- CVE
- Vendor
- PHP
What to do
7 steps
- 6 Set memory_limit=-1 and a low post_max_size where applications can’t override them until updating, which PHP says blocks some paths to CVE-2026-109618 only.
- 7 Set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart every worker until updating, which PHP says blocks the confirmed session paths to CVE-2026-109619.
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| PHP 8.5 | Before 8.5.12 | 8.5.12 |
| PHP 8.4 | Before 8.4.27 | 8.4.27 |
| PHP 8.3 | Before 8.3.36 | 8.3.36 |
| PHP 8.2 | Before 8.2.35 | 8.2.35 |
| PHP 8.1 and older | Back to 5.4, Wiz says | No release. Source backports for 7.4, 8.0 and 8.1 |
- Product
- PHP 8.5
- Affected
- Before
8.5.12 - Fixed
8.5.12
- Product
- PHP 8.4
- Affected
- Before
8.4.27 - Fixed
8.4.27
- Product
- PHP 8.3
- Affected
- Before
8.3.36 - Fixed
8.3.36
- Product
- PHP 8.2
- Affected
- Before
8.2.35 - Fixed
8.2.35
- Product
- PHP 8.1 and older
- Affected
- Back to
5.4, Wiz says - Fixed
- No release. Source backports for
7.4,8.0and8.1
Timeline
- Aug 19Wiz finds the first of the flaws.
- Aug 24Wiz reports the flaws to PHP’s security team.
- Oct 20Details leak before the planned disclosure, and PHP announces a security release for Oct 21.
- Oct 21PHP releases
8.5.12,8.4.27,8.3.36and8.2.35and publishes its advisory. - Oct 21Cloudflare and Arctic Wolf report exploitation attempts.
Sources
- PHP security advisoryPrimary source php.net
- WizPrimary source wiz.io
- CloudflarePrimary source blog.cloudflare.com
- Arctic WolfPrimary source arcticwolf.com
- Unit 42Primary source unit42.paloaltonetworks.com
- Cisco TalosPrimary source blog.talosintelligence.com
- Canadian Centre for Cyber SecurityPrimary source cyber.gc.ca