# PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched — retained record

> Retained news record from news:theregister.

Canonical: https://highsignal.app/data/records/844fd417fed3de07

[← sources](https://highsignal.app/data)


source: [news](https://highsignal.app/data/news) (news:theregister)  published 2026-10-21 15:08 ingested 2026-10-22 02:59

[original source ↗](https://www.theregister.com/security/2026/10/21/php-devs-publish-critical-bug-fix-as-site-owners-warned-pull-em-offline-if-youre-unpatched/5304519)

## extract

AI
- Nvidia woos wary Europeans with more open weights models New embedding, parsing, and reranking models promise smarter agentic RAG workflows
- Jensen Huang sends in the robot ducks to sell Nvidia's AI-everywhere vision Containerized datacenters, androids, and telecoms all feature in Berlin keynote interrupted by environmental protesters
- Nvidia's grand plan for speeding up datacenter deployments: AI trailer parks GPUzilla boasts modular bit barns could speed up deployments from six months to just two weeks
- The spec is the new code, so brush up on your prose, says Kaseya CTO Domain expertise and clear writing will matter more than syntax, and yes, that means documentation
- Happiness is the next AI KPI if Oxford boffins have their way Researchers say public subsidies for AI should be repaid in wellbeing, not just economic growth
Infosec
- Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
- Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
- Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
- Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
- Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career
FOSS
- Red Hat helps teach about tech writing But learns tough lessons about AI in the process
- NetBSD may have found a new role: The AI-free FOSS OS Increasing awareness and adoption, followed by increasing donations
- OpenAI dots inspire open source imitators amid technical difficulties Persistent agents appeal to AI companies, but demand isn't obvious
- Ubuntu 'Stonking Stingray' beta swims out: Deeper Rust 'oxidization' plus LLM speech-to-text GNOME 51 is here, and Ubuntu interim releases are getting interesting again
- Revive Raskin's 3 laws of software with humane work that considers a dev's duty of care All this, and angry NeoVim users
- Firefox 157: Could bold new look be just what Mozilla needs?* Yet another new version of Firefox, with a significant reskin

## retained text



```
PHP developers have released emergency updates for two critical vulnerabilities after cybersecurity authorities warned organizations to patch immediately or consider taking exposed applications offline.

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The project's developers urged users to update immediately.

All PHP installations serving web requests are potentially affected, including deployments using PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed, the developers said. "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."

REG AD

Jake Knott, head of threat intelligence at watchTowr, said: "As expected, watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities, with a variety of vibecoded PoCs already hitting our sensors featuring a variety of 'php2shell' User-Agents. Whilst nobody has been successful to date, we don't expect that will last long."

REG AD

"Where immediate patching is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix is available," CERT-EU said in an advisory issued ahead of the patches. The body lists both vulnerabilities with CVSS scores of 9.2.

Finnish government services and websites belonging to the Dutch parliament, cybersecurity authorities, and data protection regulator were taken offline as a precaution. Privacy campaign group noyb also temporarily withdrew its website.

PHP "powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," infosec vendor Huntress noted.

That makes identifying exposed installations a substantial job. "The number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast," said John Hammond, Huntress's senior principal security researcher. ®
```



document fetched 2026-10-24 11:21 · canonical https://theregister.com/security/2026/10/21/php-devs-publish-critical-bug-fix-as-site-owners-warned-pull-em-offline-if-youre-unpatched/5304519