PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10. The flaws, which had existed for more than a decade, allow attackers to take control of a server without credentials, even before the website starts operating normally. Cloudflare has been blocking exploitation attempts since 5:02 a.m. Paris time, but attackers are already changing their methods to bypass its rules. Wiz Research discovered the vulnerabilities within days using Wiz Atlas and two artificial intelligence models, then reported the issue to PHP on August 24. Administrators should inventory all PHP installations, apply the patches or, failing that, disable upload progress tracking and monitor for signs of attacks.
Source: Read the original article
