Critical PHP vulnerabilities call for an urgent update

PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 today, fixing two critical vulnerabilities: with a single web request, someone without credentials can run code on your server. If you run PHP in production, updating today is extremely urgent.

If your maintenance is with Nebux, as always, you don't have to do anything: everything is already up to date.

What is happening

The vulnerabilities CVE-2026-109618 and CVE-2026-109619 were published today. The PHP security team scores both 9.2 out of 10 on CVSS 4.0, the standard we cybersecurity experts use to score risks.

They affect any PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php, where an attack has already been demonstrated.

The details leaked yesterday, ahead of schedule, and PHP brought the release forward by a day.

If you can't update yet

PHP suggests these measures in the meantime. They don't fully protect you: only updating does.

For CVE-2026-109618, set these values where the application can't change them, such as php_admin_value in the FPM pool or in the Apache configuration:

memory_limit = -1
post_max_size = 8M    ; 32M if you need file uploads

Don't limit memory with RLIMIT_AS or RLIMIT_DATA, since they trigger the very failure you're trying to avoid.

For CVE-2026-109619:

session.upload_progress.enabled = 0
fatal_error_backtraces = 0    ; PHP 8.5 only

Then restart every PHP process. Changing them with ini_set() or a .user.ini won't work.

If you run PHP 8.1 or earlier

The developers no longer release fixes for these versions. Their security team has prepared patches for 8.1, 8.0 and 7.4, but you would have to compile them yourself to apply them. The safest option is to move to a supported version, bearing in mind that support for 8.2 ends on 31 December 2026. You can check how long your version is supported on endoflife.date.

What happens if you're a Nebux customer

All our customers were on supported PHP versions because we do our homework on time, so they could apply the patch right away. Our team prepared an update plan as soon as the news broke and, when PHP released the patches, we updated every service. Since the official PHP OCI image (for Docker, Podman, etc.) had not been published yet, we built a temporary one with the patch. Three hours after the release, every service was up to date (and we're talking about dozens!). And at no extra cost: it's included in the monthly fee.

The maintenance service is designed to look after what you run and keep it working, with the updates, the vulnerabilities and the wear of every day. And above all, so that in cases like this one updating is simple, with no rushed migrations and, of course, no impact on production. And not just PHP: all the software is kept up to date.

It's a fixed monthly fee based on the size and complexity of your infrastructure. If you'd like us to take care of yours, tell us about it.