Monday, 9 November 2026 · 29 Jumada I 1448 AH
Morning briefing

The morning briefing

The Maldives, every morning at 7

The stories that matter in politics, business, tourism and the atolls, written by our own newsroom. Free, one email a day, unsubscribe any time.
Technology

PHP rushes out fixes for flaws that let attackers take over web servers

The PHP project has released updates fixing two critical flaws that let code run on a web server without logging in. Updating is the only safe option, its developers say.

By Updated 2 min read
File photo: server racks in a data centre.
File photo: server racks in a data centre. Photo: PiDatacenters / Wikimedia Commons, CC BY-SA 4.0

The PHP project has released emergency security updates for two critical vulnerabilities that can allow an attacker to run code on a web server without logging in, and has urged all users to update immediately.

PHP is one of the most widely used programming languages for websites, and powers popular content management systems such as WordPress. The fixes were published on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Website operators in the Maldives running PHP are among those who need to update.

All PHP installations serving web requests are at risk, the PHP security team said, including set-ups using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where it has demonstrated an exploit in which a single request from someone who has not logged in can trigger the attack before any application code runs.

The two flaws

  • CVE-2026-109618: if PHP runs out of memory part-way through setting up a request, cleanup code can treat half-prepared data as valid.

  • CVE-2026-109619: internal data belonging to one request can survive after its memory has been freed, and a later request handled by the same worker can use it.

Both can lead to remote code execution, which could give an attacker control of the affected server.

What to do

The PHP team says there are no complete mitigations and that updating is the only safe choice. Linux distributions and long-term support vendors received the patches in advance, so updated packages should be available from them.

PHP 8.1 and older no longer receive official updates. Because of the severity, the security team has published minimal source patches for PHP 7.4, 8.0 and 8.1 for those who build PHP themselves.

For servers that cannot be updated straight away, the team lists settings that reduce exposure to specific attack paths, such as turning off session upload progress and lowering the maximum request size. It stresses that these do not make an installation safe.

A test release of the upcoming PHP 8.6, RC4, published the same day, also contains the fixes.

Related stories