Two critical security vulnerabilities have been discovered in PHP, a programming language widely used on websites around the world, that allow malicious code to be executed remotely without authentication. The PHP development team has released an emergency security update and urged users to upgrade immediately.

On the 21st (local time), the Wall Street Journal (WSJ) reported on the PHP security vulnerability dubbed 'PHP2Shell.' On the same day, the PHP development team announced a security update fixing two remote code execution vulnerabilities through its official website.

■ Code Execution Without Authentication... "9.2 Points on the CVSS 4.0 Scale"

The vulnerabilities identified are CVE-2026-109618 and CVE-2026-109619. Both are classified as serious security problems because they allow attackers to execute code on a vulnerable server without going through normal authentication. Ahead of the update, the PHP security team rated both vulnerabilities at 9.2 on the Common Vulnerability Scoring System (CVSS) 4.0 scale on the 20th, and asked administrators to prepare to apply the security patch as soon as it was released.

■ The Nature of the Vulnerabilities: Two Memory-Handling Flaws

The first vulnerability (CVE-2026-109618) occurs during the handling of out-of-memory situations. If PHP execution is interrupted while internal request data has not been fully initialized, invalid memory data can be treated as legitimate data during the subsequent cleanup process. If exploited by an attacker, this could lead to remote code execution.

The second vulnerability (CVE-2026-109619) involves internal state from a previous request remaining in memory even after it has been freed. When the same worker process handles a subsequent request, it may reference uninitialized past state, creating a security risk.

■ Scope of Impact: Broad, Including PHP-FPM and mod_php... mod_php at Comparatively Higher Risk

The range of potentially affected environments is also broad. The PHP development team listed PHP execution environments that handle web requests as at risk, including PHP-FPM, Apache's mod_php module, php-cgi, FrankenPHP, and LiteSpeed. In particular, the mod_php environment, in which Apache directly executes PHP, was assessed as carrying comparatively higher risk. The PHP development team explained that in that environment, the vulnerabilities were proven to be exploitable using only unauthenticated requests, before application code is executed.

■ Update Target Versions... 8.5.12, 8.4.27, 8.3.36, 8.2.35

To resolve the issue, the PHP development team released PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users of PHP 8.5, 8.4, 8.3, and 8.2 must update to the corresponding security-fixed version.

Servers running older versions also require inspection. PHP 8.1 and below are excluded from official security update support from the project itself. However, some Linux distributions and long-term support service providers may supply separate fixed packages. For operators of older systems, the PHP security team also separately provided minimal source code fixes applicable to PHP 7.4, 8.0, and 8.1.

■ Interim Measures Alone Are Insufficient... "The Update Is the Complete Solution"

In environments where immediate updating is difficult, server configuration changes can restrict some attack paths, but this alone does not fully resolve the security issue. Although the PHP development team presented interim mitigation measures related to memory limits, request data handling settings, and session upload progress management, it emphasized that updating is the complete solution.

■ 'Existence of a Vulnerability' ≠ 'Actual Breach'... Version and Patch Status Are Key

What must be distinguished in this case is the existence of the vulnerabilities versus whether an actual breach has occurred. The mere confirmation that unauthenticated remote code execution is possible does not mean that all PHP-based websites worldwide have been hacked or that data breaches have occurred. The actual risk varies depending on the PHP version installed on the server, how it is executed, and whether security patches have been applied.

It is also worth noting that official support for PHP 8.2 is scheduled to end on December 31. The PHP development team advised users of that version to prepare plans to migrate to a higher version before support ends.

Because these vulnerabilities relate to the PHP execution environment itself rather than to specific website application features, the response of server operators is critical. With the PHP development team having released an emergency update, corporate and institutional website administrators should first check the versions they are using and whether security patches have been applied.

[This article was written based on public official PHP security advisories and foreign media reports. The existence of security vulnerabilities does not imply that actual hacking or data breaches have occurred. AI assistance was used in part.]