MoneroForum
Monerica468x60_v1Your ad here
Social World News & Events Started Oct 21, 2026 2:33 PM

Two critical security vulnerabilities in PHP, if you run it, you should definitely update.

6 replies - 541 views - 2 thanks - 0 tippers - 5 watchers

Oct 21, 2026 2:33 PM Last edited Oct 23, 2026 4:50 PM
#1
php website

Update: There is a new announcement now: here

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

https://www.php.net/archive/2026.php#2026-10-21-5

We even took our site down early because of this, since it started to look like some people had figured out the exploits early. https://ko-net.ws/php/

Signature

Ko-Net - Privacy focused, free-speech VPS hosting.

2 thanks - 0 tippers - 5 watchers
Monerica468x60_v1Your ad here

Replies

Page 1 of 1 - 6 total
Oct 22, 2026 6:26 PM
#3

It affects WordPress, Joomla and Drupal if the memory allocation is around 128 mb.
That way PHP can be overwhelmed and force a premature server shut down.
There are not too many people around who actually can pull that off. And to what gain.
You note the critical instance, take the IP and notify the ISP.

Signature

Contact me if you are in need for a new marketing approach!

0 thanks - 0 tippers
Login to tip
Oct 22, 2026 8:02 PM
#4

@NickZ2 I have already seen a few sites hacked since the patch came out, I would suggest to be on the side of caution for this.

Signature

Ko-Net - Privacy focused, free-speech VPS hosting.

0 thanks - 0 tippers
Login to tip
Oct 23, 2026 4:23 AM
#5

The PHP core team released fixed versions of PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on Wednesday, October 21, 2026. So it has been officially patched already.

0 thanks - 0 tippers
Login to tip
Oct 23, 2026 12:42 PM
#6

I was reading my favorite novel site and it suddenly went on maintenance and I was left confused. It was crazy how many was affected by this.

Signature

I love making poster art

0 thanks - 0 tippers
Login to tip
Oct 23, 2026 4:48 PM
#7

There's a new announcement:

We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.

https://www.php.net/archive/2026.php#2026-10-23-1

Signature

Ko-Net - Privacy focused, free-speech VPS hosting.

0 thanks - 0 tippers
Login to tip

Post A Reply

You must be logged in to reply. Login or register.