PHP patches released for two critical RCEs
PHP project released new versions to address two critical vulnerabilities that could allow remote code execution.
Intelligence analysis by Qwen 2.5 (3B)
The PHP project has updated several versions to fix two critical vulnerabilities that could lead to remote code execution. These vulnerabilities affect all PHP installations serving web requests.
Imagine you're playing with building blocks. Sometimes you run out of blocks and have to clean up the mess. If you don't clean up properly, you might accidentally use a block that doesn't belong to you, and that could let someone build a tower without you knowing.
Analysis
{"heading":"CVE-2026-109618: OOM Corruption Vulnerability","subheading":"Request Cleanup May Treat Invalid Data as Valid","content":["CVE-2026-109618 is a critical vulnerability that arises from out-of-memory (OOM) handling in PHP. The vulnerability occurs when PHP attempts to clean up internal request data that is only partially initialized.","This can lead to a situation where the request cleanup process treats the invalid data as valid, potentially allowing an attacker to trigger the attack before any application code runs.","The vulnerability affects all PHP installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed."]}
Key points
- PHP project released new versions to address two critical vulnerabilities
- Affects all PHP installations serving web requests
- Mod_PHP is considered the highest risk due to a demonstrated exploit
- Linux distributions and vendors have received patches in advance
- Updated packages should be available soon
With the new patches, the risk of an attacker exploiting these vulnerabilities has been significantly reduced. Users can now be more confident in the security of their PHP installations.
While the patches have been released, it's still possible that some older systems might not have received the updates, leaving them vulnerable.