New Serious PHP Vulnerabilities Released and Patched
PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs...
- Vendor
- PHP
- Product
- PHP
- EPSS
- 1.00 (p100)
- Fix
- available
- Exposure class
- Web platform
Why it ranks 39 (Notable)
- EPSS 1.00 (high probability of exploitation)
- Product class: web platform
- Covered by 34 independent sources
- Fix available
- Reporting
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Schneier on Security (schneier.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.