Important PHP security holes put web servers at risk

Thread contains important information that may impact how you use the forum

Welcome to the Precious Metals Bug Forums

Welcome to the PMBug forums - a community supported watering hole for folks interested in gold, silver, precious metals, sound money, investing, market and economic news, central bank monetary policies, politics and more.

Register a free account to join the discussions. When you register an account and log in, you may enjoy additional benefits including access to market data/charts and additional members only rooms (including one for trade/barter with the community).

pmbug

pmbug

Your Host
Administrator
Benefactor
Messages
21,922
Reaction score
9,292
Points
268
Location
Texas
United-States
I could probably have posted this in the Digital OpSec forum, but this could potentially impact this website:
The FBI is literally telling companies to pull the plug and take their servers offline right now.

Patch your servers immediately or prepare to get wiped out.

The FBI has issued an emergency alert after two critical code execution flaws were discovered in PHP core.

PHP runs over 75% of the web, powering WordPress and millions of online stores.

The danger level is off the charts

✅ Unauthenticated attackers can hijack servers remotely

✅ No password or account needed

✅ Standard web firewalls cannot stop it

Active exploits are already hitting the wild
Click to expand...



Looks like I'm going to have to pony up to get the latest PHP & Xenforo updates when the patches are available.
 
On October 21, 2026, the PHP Foundation released emergency patches for two critical remote code execution (RCE) vulnerabilities in the core PHP runtime, collectively known as php2shell. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and affect nearly 70% of all websites by impacting every PHP installation serving web requests, including versions from PHP 5.4 through 8.5.

The vulnerabilities allow unauthenticated remote code execution and memory disclosure without requiring user interaction, with the risk being particularly severe on servers using Apache mod_php where exploits can trigger before any application code runs. The issues stem from improper memory handling during out-of-memory (OOM) errors and stale global state retention, enabling attackers to corrupt process memory or execute arbitrary code on vulnerable servers.

Patched versions released on October 21 include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For end-of-life versions (PHP 7.4–8.1), minimal source backports are available, while older versions (PHP 5.4–7.3) remain unsupported and unpatched by the PHP project. Major security providers like Cloudflare have already deployed WAF protections, and the FBI and NSA have issued warnings urging immediate updates to mitigate active exploitation attempts.
 
PHP was updated last night on the pmbug server, but the server (Apache) crashed at some point last night. Server guru rebooted as soon as he woke up this morning and is looking into the cause of the crash. Hopefully we're good to go now.
 
Server issues that caused the Apache crash have been fixed. No errors logged since. Looks like we're good to go now.
 
You must log in or register to reply here.
Back
Top Bottom