PHP security flaws explained: Affected versions, how to fix and more details

In a recent cybersecurity alert that has shook the internet, two critical vulnerabilities in PHP have put millions of websites at risk. For those unaware, PHP is a programming language used to run websites. The vulnerabilities can allow attackers to execute malicious code on a server without logging in. Several security agencies, including India’s CERT-In, the US National Security Agency (NSA) and the FBI, have also warned website owners to act quickly. PHP has released security patches to address the flaws and urged website owners to update their systems as soon as possible.

✅ Thank you for completing the survey!

What are the PHP security flaws?

PHP has revealed two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both have a severity score of 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS).

The first flaw is linked to how PHP handles memory. If the system runs out of memory while processing a request, it may incorrectly treat incomplete data as valid. The second flaw occurs when information from an earlier request is not properly cleared. A subsequent request handled by the same worker could use this leftover data. 

Attackers could exploit these weaknesses to execute code remotely on an affected server.

Also read: Millions of websites at risk? OpenAI finds critical security flaws in PHP, here is all you need to know 

Which PHP versions are affected?

The vulnerabilities affect PHP installations that process web requests. This includes commonly used configurations such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. According to PHP, the risk is highest for systems using mod_php.

Website owners and administrators should identify which PHP version and configuration their servers use and check whether security updates are available.

Also read: Anthropic introduces proactive AI agent Claude Duet: What it can do, how to access and more details 

How to fix the PHP vulnerabilities?

PHP has released fixes in the following versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Users should upgrade to the appropriate patched version as soon as possible. PHP has stated that there is no complete workaround for these vulnerabilities, making an update the recommended way to address them.

What about older PHP versions?

PHP 8.1 and earlier versions no longer receive regular official security updates. The PHP team has provided limited emergency fixes for PHP 7.4, 8.0 and 8.1 for users who compile PHP from source.

Those running older versions should check with their hosting provider or Linux distributor for available security fixes.

If an immediate update is not possible, reducing the maximum upload size may help limit exposure. However, such temporary measures do not fully protect a server from these vulnerabilities.