CRITICALVulnerability
Global

New Serious PHP Vulnerabilities Released and Patched

·Source: Schneier on Security

Updated:

Executive Summary

PHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the ris

Analysis

PHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. The vulnerabilities:...
Source Attribution

Originally published by Schneier on Security on Oct 22, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Quest Diagnostics Reports Hack on IT System Used by Clients

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/quest-diagnostics-reports-hack-on-system-used-by-clients-image_small-9-a-33185.jpg" align=right hspace=4><b>Medical Testing Lab Told SEC Incident Likely Compromised 'Certain Patient Records'</b><br>Medical testing company Quest Diagnostics has told the U.S. Securities and Exchange Commission that it's responding to a cyber inciden

Bank Info Security
MEDIUMVulnerabilityNEW

Alms For the Cyber Poor: Program Will Help Small Utilities

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/alms-for-cyber-poor-program-will-help-small-utilities-image_small-5-a-33186.jpg" align=right hspace=4><b>Dragos Has Learned That 'Free' Doesn't Always Mean 'Usable'</b><br>Dragos, a pioneer in the operational technology security market, and its new backer, consulting giant Accenture, are teaming up with the Sans Institute training

Bank Info Security
MEDIUMVulnerability

Railway warns devs to rotate secrets after potential breach

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...]

BleepingComputer