PHP Fixes Two Critical Flaws That Put Web Servers at Risk
Photo: TokenPost
PHP maintainers released fixes Oct. 21 for two critical flaws that could let attackers without credentials run code on servers handling web requests, putting crypto services that use vulnerable PHP at risk. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each have a CVSS v4.0 score of 9.2. Risk is highest on Apache servers using mod_php, where an unauthenticated request can reach PHP before application code runs. Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare observed attack traffic targeting its customers before public disclosure. The PHP Foundation had not identified a functional exploit by release time.
Source: TokenPost
