Important PHP security holes put web servers at risk

[pmbug]

I could probably have posted this in the Digital OpSec forum, but this could potentially impact this website:

The FBI is literally telling companies to pull the plug and take their servers offline right now.

Patch your servers immediately or prepare to get wiped out.

The FBI has issued an emergency alert after two critical code execution flaws were discovered in PHP core.

PHP runs over 75% of the web, powering WordPress and millions of online stores.

The danger level is off the charts

Unauthenticated attackers can hijack servers remotely

No password or account needed

Standard web firewalls cannot stop it

Active exploits are already hitting the wild

Looks like I'm going to have to pony up to get the latest PHP & Xenforo updates when the patches are available.

 

[pmbug]

PSA - this site might be offline for a short time while the server updates are applied.

 

[Goldhedge]

On October 21, 2026, the PHP Foundation released emergency patches for two critical remote code execution (RCE) vulnerabilities in the core PHP runtime, collectively known as php2shell. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and affect nearly 70% of all websites by impacting every PHP installation serving web requests, including versions from PHP 5.4 through 8.5.

The vulnerabilities allow unauthenticated remote code execution and memory disclosure without requiring user interaction, with the risk being particularly severe on servers using Apache mod_php where exploits can trigger before any application code runs. The issues stem from improper memory handling during out-of-memory (OOM) errors and stale global state retention, enabling attackers to corrupt process memory or execute arbitrary code on vulnerable servers.

Patched versions released on October 21 include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For end-of-life versions (PHP 7.4–8.1), minimal source backports are available, while older versions (PHP 5.4–7.3) remain unsupported and unpatched by the PHP project. Major security providers like Cloudflare have already deployed WAF protections, and the FBI and NSA have issued warnings urging immediate updates to mitigate active exploitation attempts.