HOME
Content Center
Content Center
Article
Threat Analysis ◦ Security Insight

Two Critical PHP Vulnerabilities Prompt Urgent Security Updates

Two critical vulnerabilities have been identified in PHP, a language widely used to develop websites and web applications. Both vulnerabilities may allow unauthenticated RCE(remote code execution), and have been rated 9.2 under CVSS v4.0. The PHP Security Team released security updates on October 21, 2026, and recommended applying them immediately.

The vulnerabilities could affect PHP web servers across several runtime environments. Internet asset search data suggests that approximately 110,000 hosts in South Korea run potentially vulnerable PHP versions. Organizations should identify affected systems and install the appropriate security updates.

What is PHP?

PHP (Hypertext Preprocessor) is a server-side scripting language widely used to develop websites and web applications.

When a user visits a website, the server executes the PHP code and delivers the result to the user as a web page. This supports a range of web functions, including login, user account management, message boards, database integration, and online payments.

PHP also powers widely used CMS (content management systems), including WordPress and Drupal. Vulnerabilities in PHP itself can therefore affect the underlying server environments, as well as the websites and applications they host.

PHP Vulnerabilities Allowing Remote Code Execution

In an official notice issued on October 20, 2026, the PHP Security Team announced upcoming security updates for two critical vulnerabilities rated 9.2 under the CVS (Common Vulnerability Scoring System), v4.0.

The team issued a formal security advisory on October 21 and confirmed that the vulnerabilities could allow an unauthenticated attacker to execute code remotely.

CVE-2026-109618 and CVE-2026-109619 both involve PHP’s internal request processing. They arise from different underlying issues, but each could allow an unauthenticated attacker to execute arbitrary code remotely. The table below summarizes their technical details.

Category CVE-2026-109618 CVE-2026-109619
Vulnerability type Data corruption during memory exhaustion handling Reuse of internal state associated with freed memory
Primary cause Processing may stop because memory is exhausted before request data has been fully initialized. During subsequent cleanup, invalid data may be treated as valid. Internal state used to process a request may remain after its memory is freed and be reused before initialization during a subsequent request.
Potential impact Unauthenticated remote code execution Unauthenticated remote code execution
Severity CVSS v4.0 9.2 CVSS v4.0 9.2

Table 1. Key Details of the Critical PHP Vulnerabilities

Both vulnerabilities are rated Critical, the highest severity level under CVSS v4.0. Actual exploitability and the scope of impact can vary by PHP version and web server runtime environment. Organizations should assess the impact on their systems against the official security advisory.

RCE is a vulnerability that allows an attacker to execute arbitrary code on a target system over a network. If an attack succeeds, it can lead to malware execution, information theft, or server compromise, depending on the execution privileges and system environment.

The PHP Security Team specifically stated that the vulnerabilities affect PHP environments that process web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Apache mod_php is considered a relatively high-risk environment because cases have been confirmed in which an unauthenticated request can trigger an attack before application code runs.

Organizations need to check both where PHP is deployed and how their web servers execute and configure it.

Updates Released for Affected PHP Versions

On October 21, 2026, the PHP Security Team released security updates to address both vulnerabilities. Fixed releases were provided for each version branch from PHP 8.2 through 8.5, and the team recommended that all users of those versions update immediately.

The fixed releases listed in the official announcement are shown below.

PHP Version Branch Security Update Release
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35

Table 2. Security Update Releases for the Critical PHP Vulnerabilities

These releases were listed in the PHP Security Team’s October 21, 2026 announcement. Organizations should identify the PHP versions they run and install the fixes for the relevant branches. For Linux distributions and managed services, check whether the vendor provides separate security updates.

Given the severity of the vulnerabilities, the PHP Security Team also provided minimal security fixes that can be applied to the source code for PHP 7.4, 8.0, and 8.1.

These fixes do not restore general security support for end-of-life PHP versions. Organizations running those versions should plan to migrate to a supported release.

The PHP Security Team stressed that temporary mitigations do not fully address the vulnerabilities. Installing the security updates remains the definitive fix.

Approximately 110,000 Potentially Vulnerable PHP Hosts Observed in South Korea

As PHP supports websites and web applications worldwide, vulnerabilities in its request-processing components could affect a substantial number of internet-facing services.

According to research based on internet asset searches and cited by AhnLab TIP, an estimated 548,420 hosts in the United States, 235,906 in China, and 193,470 in Germany were observed running vulnerable PHP versions.

In South Korea, 112,183 hosts were observed, accounting for approximately 4.35 percent of the total.

Country Observed Hosts Share
United States 548,420 21.27%
China 235,906 9.15%
Germany 193,470 7.50%
Japan 151,039 5.86%
France 121,706 4.72%
South Korea 112,183 4.35%

Table 1. Observed Hosts Estimated to Use Vulnerable PHP Versions by Country, Covering the Top Six Countries Based on Data Provided by AhnLab TIP

These figures estimate the number of hosts running potentially vulnerable PHP versions identified through internet asset searches. They do not establish that every host is affected or exploitable. Actual exposure depends on the PHP version, runtime environment, security configuration, and patch status.

Impact on Corporate Websites and Web Applications

PHP is used across a range of web services, including corporate websites, customer portals, e-commerce sites, content management systems, and internal business systems.

Because these vulnerabilities involve PHP’s internal request processing, the assessment must cover server runtime environments and security configurations, not only individual application functions.

The PHP Security Team stated that an attack can be triggered in Apache mod_php environments before application code runs. As a result, even if a web application implements separate authentication controls, those controls may not provide sufficient protection against exploitation in some server environments.

Organizations should also confirm whether vendors have applied security updates when PHP is used in external hosting, cloud, or managed service environments, as well as on web servers they operate directly.

It does not mean that a functioning website is a secure one. Exposure must be assessed against the PHP version and server configuration in use.

Recommended Security Measures for PHP Environments

AhnLab recommends the following security measures for organizations that operate PHP-based websites and web applications.

1. Identify PHP Assets and Versions

Organizations should determine whether their production web servers and web applications use PHP and identify the installed versions. The review should cover internal systems, cloud environments, and external hosting environments, as well as internet-facing services.

They should also identify the actual PHP runtime environment, including PHP-FPM, Apache mod_php, and php-cgi, to assess the impact of the vulnerabilities.

2. Install Official Security Updates

Organizations should promptly update to the fixed releases distributed by the PHP Security Team.

The currently available fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. In Linux distributions and managed service environments, organizations should review the security updates provided by the relevant vendor.

After updating, they should verify the installed version and confirm that services operate normally.

3. Review Temporary Mitigations if Immediate Patching Is Not Possible

If an immediate update is difficult, organizations may review temporary mitigations for each vulnerability in accordance with the official guidance from the PHP Security Team.

For CVE-2026-109619, the guidance recommends setting session.upload_progress.enabled=0 and restarting the PHP worker processes. In PHP 8.5 environments, setting fatal_error_backtraces=0 may also help reduce certain attack paths.

For CVE-2026-109618, the guidance recommends adjusting the PHP memory limit, file upload size, and HTTP request processing limits.

These measures are intended to reduce the risk associated with specific attack paths and do not fully resolve the vulnerabilities. They may also affect server performance and service functionality, so organizations should review the detailed conditions in the official advisory before applying them.

4. Monitor for Anomalous Web Server Activity

Organizations should review web server access and error logs and monitor for indicators of anomalous activity, including unusual HTTP requests, process execution, and suspicious file creation.

If officially confirmed indicators of compromise or detection rules are published, organizations should validate them and incorporate them into security monitoring.

5. Check Official PHP Security Notices Regularly

Although fixes are available, the PHP Security Team may publish additional technical details, guidance, or follow-up updates.

Organizations and website operators should therefore continue reviewing the official PHP website for the latest security notices, fixed releases, and vendor-specific update information.

Maintain a process for assessing new advisories against deployed PHP versions and applying any necessary updates promptly.

Prioritize Patching and Maintain Ongoing PHP Security Monitoring

The two PHP vulnerabilities warrant prompt attention as they can allow unauthenticated remote code execution.

Internet-facing servers running affected PHP versions may be exposed, depending on their runtime environment and configuration.

The PHP Security Team has released fixed versions and cautioned that temporary mitigations alone do not provide complete protection.

Organizations should identify PHP deployments, verify installed versions, and apply the relevant fixes. Continued review of PHP security advisories and monitoring for unusual web server activity can help teams respond to subsequent threats.

Since disclosure, GitHub repositories containing related proof-of-concept (PoC) code, assessment utilities, and defensive tools have appeared. AhnLab examined 100 repositories associated with php2shell, including tools for detection and mitigation and code intended to reproduce attacks.

The next article reviews these repositories, the risks associated with publicly available attack code, and precautions for using it.

References

  1. PHP Security Team, Security advisory: Critical remote code execution vulnerabilities, update now, October 21, 2026.
  2. Official PHP Website, PHP Downloads 
  3. AhnLab TIP, PHP Announces Urgent Security Updates for Two Critical Vulnerabilities Rated CVSS 9.2, October 21, 2026.


Patches and Reference Links

  • AhnLab
List