From TokenPost · · 40s
PHP Fixes Critical Web Server Flaws
PHP releases urgent patches for two high-risk vulnerabilities affecting web servers.
In brief
PHP releases urgent patches for two high-risk vulnerabilities affecting web servers. PHP 8.5.12 and other versions fix critical flaws that could let attackers run code on web servers without credentials. Originally reported by TokenPost.
Critical PHP Flaws
PHP maintainers released fixes Oct. 21 for two critical flaws that could let attackers without credentials run code on servers handling web requests.
Vulnerability Details
The vulnerabilities CVE-2026-109618 and CVE-2026-109619 each have a CVSS v4.0 score of 9.2 with highest risk on Apache servers using mod_php.
Patch Releases
Patched releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for immediate security updates.
The key point
PHP 8.5.12 and other versions fix critical flaws that could let attackers run code on web servers without credentials.
