PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
https://www.php.net/archive/2026.php#2026-10-21-5
We even took our site down early because of this, since it started to look like some people had figured out the exploits early. https://ko-net.ws/php/
Signature
Ko-Net - Privacy focused, free-speech VPS hosting.