Critical PHP issue

C

Chris2

Well-Known Member
Licensed User
Longtime User
I thought this may be of interest to some on here...
www.bbc.co.uk

Websites taken down worldwide as critical PHP cyber-security update issued

The vulnerabilities with PHP, a programming language widely used across the internet, have been described as the most significant ever found by AI.
www.bbc.co.uk www.bbc.co.uk
www.ncsc.gov.uk

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
www.ncsc.gov.uk www.ncsc.gov.uk
www.php.net

PHP

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
www.php.net www.php.net
 
I've updated to a patched version of PHP, but I've turned my server off now it's night here, waiting for hestiacp patch.
 
Last edited:
I add a php page to check PHP version using phpinfo and it shows v8.4.27 so I think the hosting has updated the php version.
 
aeric said:
I add a php page to check PHP version using phpinfo and it shows v8.4.27 so I think the hosting has updated the php version.
Click to expand...
Yes, exactly. 👍

In shared hosting environments the provider normally handles these PHP security updates automatically.

In my case, Namecheap already confirmed that the issue was resolved on their hosting platform, so users should not need to make any manual changes.

If your server is now showing PHP 8.4.27, it looks like your hosting provider has also already deployed the patched version. 👍
 
Temporary protection measures before updates (if not possible)

The window between the disclosure of such a severe vulnerability and the deployment of a patch is the most critical.

We had two available options: either keep everything open and hope our partners' websites wouldn't be compromised, or proactively reduce the attack surface, accepting temporary inconvenience. Naturally, we chose the latter, because a compromised site costs far more than a few hours of potential functional hiccups.

Our interventions were first applied to PHP's session.upload_progress, which we disabled globally across all PHP versions used both within cPanel and by hosted applications. Additionally, restrictions were placed on file uploads and forms handled via PHP—specifically on requests using the Content-Type: multipart header.
 
You must log in or register to reply here.
Back
Top