Loading story…
PHP is accelerating patches for CVE-2026-109618 and CVE-2026-109619 after information about the vulnerabilities became public ahead of coordinated disclosure. According to watchTowr CEO Ben Harris, both flaws enable remote code execution and carry CVSS scores of 10. Reports describe affected versions as extending back to PHP 5 and releases from 2004, including end-of-life branches. However, the supplied reporting provides no technical details or confirmed exploitation, and some coverage explicitly states that the vulnerabilities’ scope and patch status could not be independently verified.
The planned patch release was brought forward to October 21 at 9 AM EDT, with Kevin Beaumont identifying the expected fixed versions as 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Patches were not available when the warnings were issued. The PHP Group urged users to prepare for immediate upgrades and said it could release fixes earlier if technical details or evidence of active exploitation emerged. Organizations should inventory PHP deployments, prepare expedited testing and deployment of the announced fixes, and prioritize moving end-of-life installations to supported branches rather than assuming legacy versions will receive patches.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The PHP Group published an early notice on Tuesday afternoon, moving the planned release from Thursday to Wednesday, October 21, at 9 AM EDT and urging users to prepare for immediate upgrades. Announced fixed versions were PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; affected end-of-life branches were reported to remain vulnerable.
On Tuesday afternoon, watchTowr CEO Ben Harris confirmed that both vulnerabilities were real and previously under embargo, stating that each could enable remote code execution and carried a CVSS score of 10. He said PHP versions 5 through 8 were understood to be affected; patches were unavailable and no exploitation was confirmed.
Limited information about CVE-2026-109618 and CVE-2026-109619 circulated publicly, including on Hacker News, ahead of coordinated disclosure. Kevin Beaumont reported the leak on October 20; the supplied sources do not establish that technical exploitation details were exposed.
Sansec proposed disabling session.upload_progress.enabled and enabling session.use_strict_mode as temporary mitigations, warning that these settings do not guarantee protection. It also reported a leaked screenshot of an exploit tool called PHP2Shell, without establishing active exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
13 references tracked. Mallory keeps watching after this page renders.
sansec.io
Open sourcephoenix.security
Open sourcewordfence.com
Open sourcerunzero.com
Open sourcereddit.com
Open sourcecyberplace.social
Open sourcelabs.beazley.security
Open sourcephp.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PHP disclosed fixes for two high-severity vulnerabilities affecting multiple supported branches. `CVE-2026-17543` is an SQL injection flaw in `ext-pgsql` caused by improper escaping of backslashes in attacker-controlled parameters, enabling trivial injection through `E'...'` breakout. `CVE-2026-17544` is an out-of-bounds write in `ext-bcmath` where crafted input to `bccomp()` can trigger stack and heap corruption. Both issues are rated as network-exploitable with low attack complexity and high impact on confidentiality, integrity, and availability, and CISA SSVC metadata indicates no exploitation has been observed but both flaws are considered automatable with total technical impact. The vulnerabilities affect PHP versions before `8.2.33`, `8.3.33`, `8.4.24`, and `8.5.9`, with the `bccomp()` flaw applying to `8.4.x` and `8.5.x` before those patched releases. The Canadian Centre for Cyber Security published advisory `AV26-764`, echoing the PHP Group notice and urging users and administrators to review the vendor guidance and update affected deployments as fixes become available.
Jul 31, 2026
PHP has patched two memory-safety vulnerabilities in its `ext/standard` image-handling code that can be triggered by specially crafted JPEG input. One issue, tracked as **CVE-2025-14177**, affects `getimagesize` and can disclose uninitialized heap memory when JPEG APP segments are read across multiple chunks, potentially exposing server-side data through returned metadata such as `APP1`. A second flaw in `iptcembed` can cause a heap buffer overflow and denial of service because the function sizes its output buffer from a single `fstat()` result and then continues copying data until EOF, creating risk when processing FIFOs, pipes, sockets, or files that grow after the initial size check. The bugs were discovered by Positive Technologies researcher Nikita Sveshnikov, who published proof-of-concept demonstrations showing both filter-based and direct exploitation paths for `getimagesize`, as well as a FIFO-based overflow scenario for `iptcembed`. PHP addressed the flaws by correcting chunk-buffer pointer handling in `php_read_stream_all_chunks` and adding boundary checks and safer error handling for `iptcembed`; fixes were released in **PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1**. The most exposed deployments include public upload endpoints, CMS thumbnailing workflows, webmail platforms, and image CDNs that inspect user-supplied images on the server side.
Jun 29, 2026
A critical remote code execution vulnerability in PHP on Windows, tracked as **`CVE-2024-4577`**, allows argument injection in **PHP-CGI** through Windows Best-Fit character encoding conversion. The flaw affects supported and unsupported PHP 5.x+ versions and is especially dangerous in CGI deployments where `php-cgi.exe` or `php.exe` is exposed to the web, including common default **XAMPP**-style configurations. Researchers reported that specially crafted HTTP requests can bypass prior protections and achieve remote code execution without authentication. Security updates were released in **PHP 8.3.8, 8.2.20, and 8.1.29**, but exploitation began rapidly after disclosure. Multiple reports said attackers were using crafted POST requests to launch `mshta.exe`, retrieve a malicious HTA payload, and execute **TellYouThePass** ransomware via in-memory VBScript loading. Defenders were urged to patch immediately and, where patching was not yet possible, restrict or disable PHP-CGI exposure and apply web-server filtering and configuration mitigations to block exploit requests.
Sep 3, 2026