General
Share and discuss tech, products, business, startups, or product recommendations
Start new thread

Two PHP RCEs dropped last night. How did you handle them?

by•

Last night, two PHP security issues were revealed, CVE-2026-109618 and CVE-2026-109619. Both allowed remote code execution with no authentication needed, and they were very serious, with a vulnerability score of 9.2. Due to the extent of the impact, we found ourselves doing emergency work on client sites late that night.

What astonished people most: updating WordPress and its plugins doesn't fix it. The problem is in the PHP language itself, so the PHP on the server is what must be upgraded.

Also note that if a website is running a PHP version that's no longer supported by the PHP development team, there will be no official patch.

After the disclosure, how did you react on your part? Did you patch right away, or do something else first?

9 views

Add a comment

Replies

Best
I've shut down the servers first. Then prepared the fix. Before turning on the servers I've closed HTTP(S)/3 ports. Checked that all new versions applied after the deploy and only then opened it up again. At the same time a friend of mine refused to shut down the servers and only applied some minor mitigations (he runs old OS and PHP that can't be updated). Somehow he's not worried and there was noting I could say to change his mind. He decided to get back to this next week 🤯

 Shutting everything down first and checking the versions before opening back up is about as careful as it gets.

Your friend's case is the one I'd worry about. If his PHP is 7.4 to 8.1 there's only a source fix, no official release, and anything older than that gets nothing at all. Cloudflare was already saying early attacks were showing up, so next week might be cutting it close.