PHP Warns It Plans To Release 2 Emergency Patches Imminently

An anonymous reader quotes a report from Ars Technica: Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.

"All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," the advisory stated. "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here.

Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real. Researchers from separate security firm Sansec said they "expect mass attacks to start within 15 minutes of the release." A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.

Woosh.... a bit late, Slashdot...

[Anonymous Coward]

Those patches came online an hour ago, a 24 hours too late given AI and the active exploits that occurred. Government sites in Europe went down out of precaution, this was a Crowdstrike-esque one, albeit without (yet) the same service denials.

Re:

[Anonymous Coward]

Besides, it is PHP, emergency patches used to be the norm back when I last heard of it.

Anyone who uses shit written in that PoS "framework" should have worn fire-retardant pants 20 years ago already.

Patching live servers was, like, yo, man, that's a third of my daily chore.

Re:

[Rei]

And here comes Node.js [nodejs.org]....

Re:

[nyet]

still no sid/forky

Notice link

[The-Ixian]

https://www.php.net/index.php#... [php.net]

Re:

[xevioso]

Out hosting company, Pantheon, is on the ball. I was prepared to make the PHP updates myself, but they had already intiated the process .
https://status.pantheon.io/inc... [pantheon.io]

Most excellent, they did it for everyone on the platform rather than require folks to make the updates themselves.

On a side note, Asana was down for us for a bit this morning too. Everyone was concerned; my suspicion was that they were making the emergency rollout of the updates and needed to restart their servers/ app globally. That is

Already patched

[mrspoonsi]

Security advisory: Critical remote code execution vulnerabilities, update now PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. The vulnerabilities: RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid. RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it. How to update: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Source downloads are on our downloads page. Windows source and binaries are on the same page. Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages. PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version. Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. If you cannot update immediately: while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.

I've been worried about PHP

[93 Escort Wagon]

Things have been somewhat quiet on the PHP security front for the past several years, and it's really bothered me. It has seemed like the PHP developers have forgotten their roots... forgotten what made them so beloved. So imagine my joy when I read this announcement! The devs have obviously now refocused on returning to their core competencies.

Re:

[DamnOregonian]

I was getting more and more disappointed in you as I read this comment... and then you dropped the punchline.
Fucking brilliant.

for those curious

[ucho]

Fix is in commit 01a40e8 and it is quite large, they had to fix that OOM failure everywhere, not only in that file upload handling, that was already found to be exploitable.

Re:

[tijgertje]

You are an idiot.
There will be automatic attacks just attacking every server on the internet.

Re:

[MachineShedFred]

Yes, because we all know that criminals only attack things they are interested in, and would never perform theft-of-service on any old server they find a known exploit works on.

If you actually work somewhere professionally with this attitude, you need to be fired.

Re:A better patch:

[Anonymous Coward]

Perl it is then!

Re:

[93 Escort Wagon]

Please let us know as soon as the Wordpress, Drupal, Joomla, etc. front-end systems have been rewritten in perl!

Re:

[DamnOregonian]

About time someone in this comment section started talking sense.

Re:

[ucho]

Does "anything" include C? Those bugs would be easier to avoid if PHP itself was written in something (more) memory safe.

Re:

[bjoast]

PHP 8 should be rewritten in PHP 4. It is time-tested.

My Surprise

[SlashbotAgent]

Despite its flaws, vulnerabilities, and haters I think that PHP is a good or admirable language for web servers.

But in this day of node and Javascript, and with AI's penchant for Typescript and React, I'm surprised that PHP is still heavily used.

Re:My Surprise

[Zarjazz]

PHP has an exceptionally low level of entry for newbie developers, and combine that with a huge legacy install base -- all those apps listed in the article are at least a decade old -- that means it'll be around for some time yet.

Re:

[alvinrod]

Also, rewrites are expensive and often introduce a new set of bugs in the process. They usually break a lot of third party add-ons or other custom modules as well. There's nothing stopping anyone from writing a new CMS in a more modern language (I'm surprised the rust cult hasn't pounced all over this to be honest) but most people are happy using what they already have because it's easier or less expensive to continue using it. There are plenty of systems still running ancient COBOL code and will probably s

Re:

[SlashbotAgent]

I'm surprised the rust cult hasn't pounced all over this to be honest

A Rusty replacement for WordPress sounds like a good thing.

Re:

[93 Escort Wagon]

Anything that leaves us Mullenweg-free is a good thing!

Re:My Surprise

[CommunityMember]

Despite its flaws, vulnerabilities, and haters I think that PHP is a good or admirable language for web servers.

But in this day of node and Javascript, and with AI's penchant for Typescript and React, I'm surprised that PHP is still heavily used.

Wordpress uses PHP. And something close to 40% of the internet sites use Wordpress (so, PHP).

Re:

[Goddamnferret]

I'm a little embarrassed I didn't know this. When I saw the warnings to update I looked it up and yup, PHP. Been too busy with the certificates though, hoping GoDaddy handles those PHP updates!

Re:

[93 Escort Wagon]

But in this day of node and Javascript, and with AI's penchant for Typescript and React, I'm surprised that PHP is still heavily used.

Given node's track record vis a vis security, this might not be the best time to mention that.

Re:

[atari_kid]

Yes, somebody just mentioned in a Youtube video that PHP is a old legacy language. It made me feel old as one of my first jobs in the computer industry was writing web apps in PHP.

Re:My Surprise

[Tarlus]

It made me feel old as one of my first jobs in the computer industry was writing web apps in PHP.

This sentence made me feel old, but not for the same reason.

Re:

[Going_Digital]

The only reason PHP hangs around for us is large scale open source projects like Drupal. Anything developed in house is built in Go for the last 5 years.

Debian fixed

[bill_mcgonigle]

Looks like both bookworm and trixie are fixed as of about 3am UTC last night.

Sync your mirrors if it's off cycle. Luckily mine sync around 9am, hopefully the buildbots were busy..

For bookworm you need 8.2.35-1~deb12u1 .

Thank you, Guilhem.

Re:

[nyet]

does not work for sid/forky due to libsodium

Lots of legacy stuff will be taken down

[xack]

Which will help improve the overall health of the internet in the long term.

Re:

[MIPSPro]

Doubtful... Have you seen "the new web" lately? The coding frameworks have changed, but it's still a giant JS monoculture just as ripe for a big exploit in one of the JS engines as in PHP's engine. Letting other untrusted people run code on your machine, even in a "sandbox" is always going to have risks. Sure, someone will say "but but Rust and Go will solve all of this for us!" well.. ooooookaaaaaay. Better get started then, because if you think PHP is the only place were web programming went sideways you'

Re:

[ihadafivedigituid]

Amen to all of that.

Part of the reason I write my own frameworks is because they are all incomprehensible (and therefore un-securable) shitshows. I can write my own much smaller, simpler, and more understandable shitshow and get better performance & security in the process.

Exploits already out ...

[kbahey]

This should have been posted before 10 am EDT.

Ubuntu LTS (26.04, 24,04, and 22.04) got the fix yesterday, as patches to the existing PHP version.

This is from 24.04:

Upgraded:
php8.3-bcmath:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
php8.3-cgi:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
php8.3-cli:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
php8.3-com

Re:

[kriston]

I thought the announcement said we had to upgrade to 8.3.36, not 8.3.6.

Re:

[kbahey]

If you are using a distro with long term support (LTS), like I am, they backport the patch to the version that they have.

I am on Ubuntu Server 24.04 LTS, and the change was from

8.3.6-0ubuntu0.24.04.11
To
8.3.6-0ubuntu0.24.04.12

So, .11 to .12.

Re:

[kriston]

That explains it. I wish it were more clear because it confused everyone I've been discussing this with, including myself.

Re:

[kbahey]

Actually, the .12 had fixes for other PHP CVEs.
But it was a .13 that did fix the CVEs in question (which are remote code executions).

The repositories were being hammered and the fix was delayed for most people.

Excerpt:

Changes for php8.3 (php8.3-zip php8.3-xml php8.3-readline php8.3-opcache php8.3-cli php8.3-phpdbg php8.3-mysql php8.3-mbstring php8.3-gd php8.3-fpm php8.3-dev php8.3-curl php8.3-cgi php8.3-bcmath php8.3-common) ---
php8.3 (8.3.6-0ubuntu0.24.04.13) noble-security; urgency=medium

*

WordPress, still and always.

[jddj]

"A remote root shell with a cool blogging feature!" ...recalls this WordPress user.

Re: WordPress, still and always.

[drinkypoo]

WordPress has its own special problems but this will also affect sites running other things like Drupal.

Re:

[jddj]

Drupal and others, reaching for feature parity.

SELinux?

[whoever57]

How much protection does SELinux provide for this vulnerability?

Re:

[nyet]

none, its mostly theater imo

Re:

[DamnOregonian]

SELinux provides precisely as much protection against this your policy allows for.
In this instance, where it could be particularly useful is preventing the spawning of anything but a specific set of allowed processes.

I hope you are not employed to administrate servers. I have the feeling you're the kind of administrator that issues `setenforce 0` when it prevents you from doing something you wanted to do in a context you weren't allowed to do it in, and then calls that theater.

backports

[awwshit]

Ubuntu now has backports for Pro users.

Thank you backport Angels.

PHP security cluster fuck

[bloodhawk]

PHP has been a running security clusterfuck since inception where security took a backseat to ease of use and adoption. It always astounded me it became so popular despite always being insecure.

Re:

[DamnOregonian]

It always astounded me

Not me.
It precisely lived up to my opinion of the average level of human competence.

Wait, people still use PHP?

[EmagGeek]

This, I was not aware of. Guess I'll just go on with my day.

Re:

[jhutch2000]

70% of the internet runs on PHP. Still. How you haven't notice that is kind of astounding.