🚨PHP Foundation Issues Critical Security Updates for PHP 5+
Millions of sites at risk from PHP flaws
TL;DR
The PHP Foundation released emergency updates to fix critical security flaws affecting all PHP installations from version 5. Millions of systems are potentially impacted, with experts warning of dire consequences if unpatched.
The PHP Foundation has released emergency security updates to fix critical vulnerabilities in PHP, affecting all installations from version 5. These flaws, rated 9.2 on the CVSS scale, could allow malicious actors to exploit systems before updates are applied. Developers and IT teams need to act fast to mitigate risks, especially given reports of early attacks and offline websites as a precaution. PHP 8.2 and newer are the only supported versions receiving patches, with some third-party vendors still providing legacy fixes. The EU-CERT, Australia's cybersecurity agency, and the UK's NCSC have all issued warnings to prepare for immediate updates.
Key Points
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, impact all PHP installations serving web requests since PHP 5, released in July 2004.
PHP 8.2 and newer are the only supported versions receiving patches, with some third-party vendors still producing legacy fixes.
The vulnerabilities have a CVSS score of 9.2, indicating high severity and potential for widespread exploitation.
Cloudflare reported seeing early attacks before the PHP Foundation detailed the vulnerabilities and released fixes.
The Finnish government, French government, and Port of Rotterdam's website were offline due to the security concerns.
Why It Matters
If you're running PHP on your web servers, especially older versions, you need to update now. The critical flaws could allow hackers to exploit your systems before you act. The PHP Foundation's emergency updates are crucial, but only for supported versions. Unpatched systems are at high risk.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.