PSA: Critical PHP vulnerabilities

[Naz]

The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

Thank you for helping us keep PHP secure.

PHP: News Archive - 2026

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

 

[Chris D]

Thread '🚨 URGENT: Update your PHP immediately'

Wednesday at 3:11 PM

A critical security issue has been discovered affecting PHP versions dating back to PHP 5.4. These vulnerabilities can allow attackers to execute arbitrary commands on affected servers without authentication.

If you are running an unpatched version of PHP, you must upgrade immediately. If you are running PHP 8.1 or earlier, you should move to a supported, patched version. The minimum officially supported PHP version containing these fixes is PHP 8.2.35. PHP 8.3.36, 8.4.27 and 8.5.12 are also patched.

Please see the official PHP security advisory for more...

• XenForo
• Replies: 0
• Forum: Announcements

• 
• 
• 

 

[Wildcat Media]

Cloudflare deploys protections against php2shell vulnerability

Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.

blog.cloudflare.com

We still all need to patch our PHP, but at least Cloudflare was on it early enough.

 

[Alvin63]

Is this something my server will do automatically?

 

[ENF]

Is this something my server will do automatically?

No. Unless you're on XF cloud. Talk to your host if you're not sure how it works.

 

[smallwheels]

Is this something my server will do automatically?

If you run your own server or VPS you have to care yourself. If you run on shared hosting or a managed server your hoster is in charge. How fast he acts is probably an indicator of quality.

 

[Alvin63]

Emailed the server to check (shared hosting) - I'm currently showing as on 8.3.35 so looks like it hasn't been done yet - it needs 8.3.36 doesn't it? Good that Cloudflare have put some protection in place but presumably that's not enough?

 

[DocKnight]

Emailed the server to check (shared hosting) - I'm currently showing as on 8.3.35 so looks like it hasn't been done yet - it needs 8.3.36 doesn't it? Good that Cloudflare have put some protection in place but presumably that's not enough?

Correct on both accounts.

 

[Alvin63]

They replied saying they've put measures in place until they receive the patches - which sounds fair enough.

 

[Digital Doctor]

What would be a Quick explanation of what the vulnerability is ? Anyone ?

 

[ehd]

What would be a Quick explanation of what the vulnerability is ? Anyone ?

php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP

Zwei Fehler machen Webserver mit PHP aus dem Netz angreifbar. Betroffen: Versionen der letzten 20 Jahre, Admins sollten patchen.

www.heise.de

Watch the video.

 

[smallwheels]

What would be a Quick explanation of what the vulnerability is ? Anyone ?

How about reading it yourself?

critical vulnerabilities that can allow unauthenticated remote code execution.

PHP: News Archive - 2026

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

Is is as bad as it can get.

The vulnerabilities:

• RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

 

[rdn]

Done patching all managed servers.

I migrated from Ubuntu Launchpad (https://launchpad.net/~ondrej/+archive/ubuntu/php), which is still being built right now, to the main Sury repo (https://packages.sury.org/php/README.txt).

 

[Dragonfruit]

Would be nice if we can get an update release for 2.1 that supports PHP 8.0+

I'm not a big fan of the editor on 2.2-2.3, and have been waiting for 2.4. Since a lot of custom built things have to be upgraded, I didn't want to do multiple upgrades.

If that's a possibility @Chris D

Thanks

 

[Chris D]

It is not a possibility. Just like it's not a possibility for PHP to release updates for versions below 8.2. There has to be a sensible cut off and the sensible cut off for XF 2.1 was years ago.

 

[Eris Greyrat]

Here, ChatGPT helped a researcher find a PHP vulnerability and patch it

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[Dragonfruit]

It is not a possibility. Just like it's not a possibility for PHP to release updates for versions below 8.2. There has to be a sensible cut off and the sensible cut off for XF 2.1 was years ago.

I've applied the workarounds, will still wait out for 2.4.

 

[MattStibbs]

Whilst we're waiting for our shared hosting provider to apply the patch, is there a way that we can take the site offline such that the vulnerability is not exposed?

 

[Chris D]

I'd just move hosts to be honest.

 

[Alvin63]

Whilst we're waiting for our shared hosting provider to apply the patch, is there a way that we can take the site offline such that the vulnerability is not exposed?

On Cloudflare you can set an "under maintenance" snippet which basically blocks the site with a 503 and displays a message saying whatever you change the html to say (it populates a standard one about site under maintenance). As part of that you set a rule and can put in the custom expression

http.host contains "forumname.com" and not ip.src eq xxxxxxxx (xxxx being your IP address)

So it blocks everything except your IP. So you can keep checking acp to see when the php version changes.

I've just taken mine offline that way. Apparently 503 is better for Google than 403.

Presumably your host has mitigations in place. Mine says it has but not comfortable about relying on that after a number of hours.