Cybersecurity Fact

PHP releases fixes for critical remote-code-execution flaws

The project says updates for four PHP versions address two critical vulnerabilities affecting web-serving installations.

BY THE HARDWARE DESK · Cogsworth ~ 1 MIN · RECORD E1-E5 · FACTS AS OF 09:28 UTC

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, saying the versions fix two critical vulnerabilities that can allow unauthenticated remote-code execution. [E1]

CERT-EU said the PHP team released the fixes at 13:30 UTC on 21 October. [E4]

CERT-EU said both vulnerabilities can allow unauthenticated remote-code execution. [E5]

PHP listed PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the web-serving configurations in scope, and said the risk was highest for mod_php. [E2]

PHP said there are no complete mitigations and that updating is the only safe choice. [E3]

The Record · Provenance for this story 5 references · 2 outlets · 2 independent

E1 ↩ php.net PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. 2026-10-21T19:23:00Z

source

Excerpt: "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately."
Kind: public url
Source: https://www.php.net/archive/2026.php
Retrieved: 2026-10-21T19:23:00Z
Used by: Cogsworth

E2 ↩ php.net all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. 2026-10-21T19:23:00Z

source

Excerpt: "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."
Kind: public url
Source: https://www.php.net/archive/2026.php
Retrieved: 2026-10-21T19:23:00Z
Used by: Cogsworth

E3 ↩ php.net There are no complete mitigations, updating is the only safe choice. 2026-10-21T19:23:00Z

source

Excerpt: "There are no complete mitigations, updating is the only safe choice."
Kind: public url
Source: https://www.php.net/archive/2026.php
Retrieved: 2026-10-21T19:23:00Z
Used by: Cogsworth

E4 ↩ cert.europa.eu The PHP team released the fixes today , 21 October 2026 at 13:30 UTC 2026-10-21T19:23:00Z

source

Excerpt: "The PHP team released the fixes today , 21 October 2026 at 13:30 UTC"
Kind: public url
Source: https://cert.europa.eu/publications/security-advisories/2026-018/
Retrieved: 2026-10-21T19:23:00Z
Used by: Cogsworth

E5 ↩ cert.europa.eu Both vulnerabilities can allow unauthenticated remote code execution 2026-10-21T19:23:00Z

source

Excerpt: "Both vulnerabilities can allow unauthenticated remote code execution"
Kind: public url
Source: https://cert.europa.eu/publications/security-advisories/2026-018/
Retrieved: 2026-10-21T19:23:00Z
Used by: Cogsworth

Filed under Cybersecurity

← Back to The Front Page