Recent revelations of two significant vulnerabilities in PHP have ignited urgent security alarms among website administrators, hosting companies, and businesses utilizing WordPress and other PHP-centric platforms.
- PHP – CRITICAL SOFTWARE
- Meanwhile, government websites taken offline as PHP security crisis spreads
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, have both been designated with a severity rating of 9.2 out of 10 on the CVSS v4.0 scale, indicating a potential for remote code execution.
PHP – CRITICAL SOFTWARE
PHP stands as a cornerstone programming language instrumental in rendering and delivering online content from servers to users’ browsers.
This free and open-source software is curated by a collaborative global community and is fundamental to the contemporary internet.
According to W3Techs, PHP is utilized by approximately 75% of websites where the server-side programming language can be identified.
Notably, it serves as the backbone for WordPress, which powers about 43% of all websites, spanning blogs, business platforms, governmental sites, e-commerce stores, and news outlets.
Automattic, the organization behind WordPress.com, commented: “While we refrain from detailing security concerns, our team is well-prepared and has been collaborating with the PHP security team to facilitate a seamless update process.”
In contrast to conventional WordPress security incidents involving vulnerable plugins or themes, these vulnerabilities are ingrained within PHP itself.
Consequently, the potential ramifications extend far beyond individual websites and applications running susceptible PHP versions.
WordPress heavily relies on PHP for processing much of its server-side operations, while this programming language is also prevalent across various content management systems, web applications, and hosting environments.
Cybersecurity authorities in Australia have issued an urgent warning regarding these vulnerabilities, urging organizations to act swiftly in light of publicly accessible exploitation details and evidence of active exploitation attempts.
The PHP project had originally planned an emergency security release for October 21 at 14:00 UTC, following the designation of both vulnerabilities as critical.
Subsequently, security updates have been rolled out for supported PHP branches, with patched versions now including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Systems utilizing versions below these in each affected branch are advised to upgrade.
One of the vulnerabilities pertains to the retention of stale global state between PHP requests, which under specific conditions can lead to a use-after-free status capable of being exploited for remote code execution.
The second flaw is associated with corruption that occurs during out-of-memory scenarios, with techniques such as multipart request processing able to precipitate the vulnerable condition.
For operators of WordPress websites, the issue is not resolvable by merely updating WordPress itself, as the vulnerable component resides beneath the content management system at the PHP server level.
Administrators can verify the PHP version utilized by their WordPress installation via Tools > Site Health > Info > Server, although actual upgrades to PHP typically necessitate action through the hosting control panel or engagement of the hosting provider.
Website proprietors leveraging managed hosting should ensure their provider has deployed a patched PHP version, while those managing their own VPS or dedicated servers must update the pertinent PHP packages and restart any impacted PHP services.
A temporary mitigation strategy discussed during the disclosure phase involved disabling PHP’s session upload progress feature with the following configuration:
session.upload_progress.enabled = Off
However, France’s CERT has cautioned that this measure only reduces exposure for one of the vulnerabilities and should not be viewed as a substitute for implementing the necessary security updates.
The advisories from the PHP project name PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as the patched versions, making the verification of the installed PHP release a critical immediate task for website operators.
Meanwhile, government websites taken offline as PHP security crisis spreads
In light of emerging reports indicating that attackers were attempting to exploit the newly unveiled PHP vulnerabilities, government agencies in Europe have proactively taken several websites offline as a precautionary measure.
Affected government sites include those in the Netherlands, Finland, and France, as agencies sought to mitigate exposure while awaiting the availability of patched PHP versions.
On October 21, the PHP project released fixed versions, comprising PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, warning that the two vulnerabilities had the potential to enable unauthenticated remote code execution across PHP installations serving web requests.
This disruption underscored the magnitude of the threat since PHP is integral to a myriad of websites, including those utilizing WordPress, Drupal, Joomla, and Magento, as well as various shared hosting platforms, control panels, and bespoke web applications.
Dane Knecht, Chief Technology Officer at Cloudflare, remarked on the emergence of early attacks, emphasizing that while the company has updated firewall mitigations to address new exploitation techniques, these safeguards serve only as a temporary measure.
“We are witnessing the onset of early attacks and are continuously updating our mitigations as new vectors arise. This is merely a STOPGAP. It is imperative to apply patches as soon as PHP releases the update,” Knecht stated on X.
Wordfence also temporarily disabled several of its services while implementing mitigations for what it characterized as the PHP2Shell vulnerability, as indicated by disruptions on its status page affecting plugin servers, Wordfence Central, and its main website.
For WordPress administrators, this incident serves as a pivotal reminder that automatic updates for WordPress core, plugins, or themes do not encompass PHP itself.
The server runtime requires patching by the hosting provider, system administrator, or the individual managing the hosting environment.
Cybersecurity officials in Australia, Europe, Japan, and the United Kingdom have implored organizations to urgently apply the PHP updates, with some advising operators to consider disabling vulnerable systems if patches cannot be swiftly deployed.
The PHP project has reiterated that no complete mitigations exist for these vulnerabilities, asserting that upgrading to a patched release remains the sole secure long-term response.
This incident accentuates for businesses operating WordPress that website security extends well beyond the realm of the WordPress core, themes, and plugins, highlighting the risks posed by vulnerabilities in PHP, web servers, and the underlying operating systems that may compromise otherwise thoroughly updated sites.
Source link: Techbusinessnews.com.au.
