PHP Patches Critical RCE Vulnerabilities in Security Update

PHP has rolled out a critical security update addressing two vulnerabilities that allow unauthenticated remote code execution (RCE). Known as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities affect PHP installations, especially those using Apache mod_php, with a CVSS score of 9.2. Immediate updates are necessary, particularly for internet-facing deployments.

Why It Matters for Production Environments

In production settings, security is paramount. The vulnerabilities stem from how PHP handles memory and request states, potentially allowing attackers to execute arbitrary code. This threat is significant for servers running PHP-FPM, Apache mod_php, and other configurations like php-cgi, FrankenPHP, and LiteSpeed. Exploits have been seen in the wild, with Cloudflare noting attack traffic that targets these specific vulnerabilities. If you're running a newsroom CMS where timely publication is crucial, a breach could lead to data leaks or unauthorized content changes, affecting both credibility and operations.

Updating PHP to Address the Vulnerabilities

To mitigate these risks, apply the updates provided by PHP:

• PHP 8.5: Update to version 8.5.12
• PHP 8.4: Update to version 8.4.27
• PHP 8.3: Update to version 8.3.36
• PHP 8.2: Update to version 8.2.35

For older versions like PHP 8.1 and earlier, which lack regular upstream support, seek backported fixes from your distributor or upgrade to supported releases. I'd recommend a thorough check of all PHP installations as part of your update process. Use scripts to automate version checks across servers, especially if your infrastructure spans multiple environments. Here's a simple script to help identify PHP versions across your systems:

#!/bin/bash
find / -name 'php' -type f 2>/dev/null | while read -r php_bin; do
    version=$($php_bin -v 2>/dev/null | head -n 1)
    echo "$php_bin: $version"
done

Temporary Mitigations If Updates Can't Be Applied Immediately

If immediate updates are not feasible, consider these temporary mitigations:

• Set memory_limit=-1 administratively to avoid out-of-memory corruption. This can be done via php_admin_value in your Apache or PHP-FPM configuration. Remember, this setting removes PHP's memory cap, leading to potential resource exhaustion, so monitor memory usage closely.
• Disable session.upload_progress.enabled by setting it to 0 before request parsing. This can be configured in php.ini or directly in your server configuration. Restart all PHP services to apply this change.
• Apply conservative request limits and manage input size to reduce attack vectors. For instance, set post_max_size=8M for applications not needing file uploads, or post_max_size=32M where uploads are necessary. These limits can help control resource consumption and prevent potential buffer overflows.

While these steps reduce risk, they do not replace the need for patching. In environments like a newsroom, where content integrity is critical, temporary measures should be complemented with continuous monitoring of application logs for any suspicious activity.

What This Update Does Not Solve

This update does not address installations using unsupported PHP versions beyond limited source backports. Organizations relying on older PHP versions should move to supported versions to ensure ongoing security and stability. Furthermore, temporary mitigations should not be seen as long-term solutions, as they merely reduce the risk of exploitation without eliminating it.

I'd also stress the importance of reviewing any dependencies your PHP applications may have, especially if they rely on older or deprecated PHP functions. These can introduce additional vulnerabilities that patches won't fix. Conduct a comprehensive audit of your codebase and third-party libraries to identify potential risks.

How Does This Impact Cloud and Container Environments?

PHP vulnerabilities extend to cloud-native deployments, including AWS AMIs, container images, and Kubernetes workloads. Tools like Qualys TotalCloud can identify vulnerable components across these environments, helping teams prioritize remediation in actively running applications. If you're using containers, ensure that your DevOps pipelines are updated to pull the latest, patched base images and that these images are used in your deployments.

For those running PHP in containers, remember to update the base image and redeploy to ensure the patched version is used. This prevents scenarios where the host is patched, but containers continue running vulnerable versions. Establish a routine in your CI/CD process to check for updates to PHP and other critical software packages, automatically rebuilding and redeploying containers as necessary.

Verifying Remediation

After applying updates, verification is crucial. Ensure all PHP instances are using the patched versions:

• Check the PHP version in use with php -v and ensure it matches the updated version.
• Restart PHP services or redeploy containers to apply changes. Confirm that no old versions are lingering by checking process lists and server logs.
• Review any temporary configuration changes made during mitigation efforts. After confirming updates, revert settings like memory_limit=-1 to appropriate values to maintain stability and performance.

This verification process is particularly critical in environments where downtime is not an option, such as media sites or e-commerce platforms. I'd suggest setting up automated tests to ensure that your applications are still functioning as expected after deploying updates, minimizing the risk of unexpected issues during peak traffic times.