PHP urges immediate updates for two critical remote code execution flaws

PHP has released emergency security updates for two critical vulnerabilities that can allow attackers to execute code without authentication. The PHP project urges all users to update immediately since every PHP installation serving web requests is at risk, and temporary mitigations do not provide complete protection.

The flaws affect the PHP runtime itself, rather than a particular application. Updating a website or application alone does not fix the underlying runtime.

What is affected and what to install

The PHP security notice identifies:

• CVE-2026-109618: Out-of-memory handling can leave internal request data partially initialised, causing cleanup to treat invalid data as valid.

• CVE-2026-109619: Internal state can survive after its backing memory is freed, allowing a later request to use stale state.

• Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Affected deployments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod_php the highest risk, with a demonstrated exploit that runs before application code executes. Other deployment models should not be assumed safe.

PHP 8.1 and older no longer receive upstream updates. If your Organisation still uses these branches, a clear recommendation is to move to a supported version or follow a risk based approach considering compensating measures in place.

Exploitation attempts have been reported

The Hacker News reports that Cloudflare and watchTowr observed exploitation attempts. Its updated account reports no confirmed compromise of a specific server. That distinction matter since an attack activity supports urgent action, but this does not yet establish that a healthcare organisation or medical product has been breached.

Why this matters for MedTech

The NCSC warns that appliances and third-party services may bundle PHP. Discovery should therefore extend beyond public websites to supplier-managed services and product dependencies.

For MedTech teams, assess whether an affected service supports device operation, maintenance, clinical data access or care delivery. A compromise or an unplanned shutdown during remediation could disrupt those functions. Therefore, it is advisable to coordinate containment and deployment with clinical owners, including downtime procedures and recovery checks.

Your immediate priorities

1. Find exposed runtimes. Start by reviewing SBOMs, deployment records and supplier inventories, prioritising internet-facing systems.

2. Deploy and verify fixes. Confirm the vendor-fixed package or container image, update the serving runtime, and restart relevant services and workers, as the reporting advises. Then validate critical clinical workflows afterwards.

3. Treat workarounds as temporary. Follow PHP’s deployment-specific instructions epecially since configuration changes reduce particular attack paths but they do not make an installation safe.

4. Investigate unresolved exposure. NCSC recommends checking for compromise and backdoors where immediate updating or disabling is unavailable, and considering taking systems offline if temporary mitigation cannot be applied promptly.

For regulated products, document exposure, patient-safety assessment, validation evidence and customer communications. Confirm any product-specific reporting obligations with regulatory specialists.

Further reading:
The National Cyber Security Centre : Critical security issue affecting PHP
php: Security advisory: Critical remote code execution vulnerabilities, update now
TheHackerNews: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge