Two critical security flaws have been discovered in the PHP programming language, affecting a vast number of websites worldwide. On October 21, PHP developers released emergency updates to address these vulnerabilities, which could allow attackers to remotely take control of servers without authentication. The flaws impact all PHP installations serving web requests, including those running popular content management systems such as WordPress, Joomla, Drupal, and e-commerce platforms like Magento.
Details of the Vulnerabilities
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, each received a 9.2 out of 10 severity score on the CVSS scale. The first flaw involves out-of-memory (OOM) corruption, where improper handling of memory limits can interrupt PHP during request processing, potentially leading to remote code execution (RCE). The second flaw is related to stale global state, in which internal state data may persist after its memory is freed, allowing subsequent requests to exploit this leftover data before normal initialization occurs.
Who Is at Risk?
All PHP environments that handle web requests are at risk, particularly those using Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed. The risk is considered highest for mod_php setups, where an exploit can be triggered before any application code runs. Systems running older, unsupported PHP versions are especially vulnerable, as they no longer receive official updates from the PHP project, though some vendors may provide backported fixes.
Implications for Industry Stakeholders
For operators, affiliates, and suppliers in the iGaming and online betting sectors, these vulnerabilities pose a significant threat to both security and business continuity. Many industry websites rely on PHP-based platforms for their front-end and back-end operations. A successful attack could compromise customer data, disrupt services, and damage reputations. Regulators may also increase scrutiny of affected operators, given the potential for widespread impact. Immediate patching is critical to maintaining compliance and protecting user data.
Mitigation and Next Steps
Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. All users are strongly advised to update as soon as possible. Some Linux distributions and long-term support vendors have distributed patches in advance. For those unable to update immediately, temporary mitigation measures are recommended, including adjusting memory and session settings, but these do not fully eliminate the risk. Users of unsupported PHP versions should consider upgrading or contacting their vendors for backported security fixes.
Key takeaways
- Two critical PHP vulnerabilities allow unauthenticated remote code execution.
- All PHP-driven web servers, including popular CMS and e-commerce platforms, are at risk.
- Immediate updates to the latest PHP versions are strongly recommended.
- Operators and affiliates should act swiftly to safeguard data and maintain compliance.