Particle.news
Download on the App Store
16 ARTICLES
·
20h ago

Critical PHP Flaws Trigger Emergency Patches and Precautionary Website Shutdowns

Cyber authorities warned that two memory bugs can allow unauthenticated remote code execution so operators were ordered to patch or temporarily disconnect exposed systems.

El sitio web de The PHP Foundation se ha actualizado a la versión más reciente de PHP. Una vulnerabilidad de seguridad grave, recién descubierta, está comprometiendo los cimientos de numerosos sitios web y servicios en línea en todo el mundo
La alerta de seguridad llevó a distintas organizaciones a suspender temporalmente el acceso público a sus páginas mientras preparaban la actualización de sus sistemas. La medida buscaba reducir el riesgo de intrusiones antes de instalar los parches. Foto: Pexels.
1. Qué pasó con las páginas web de varios gobiernos y cuál es el riesgo de las fallas en PHP.
Alerta informática en la UB.

Overview

  • The PHP project released fixes for four actively maintained branches on Wednesday, October 21, 2026, addressing CVE-2026-109618 and CVE-2026-109619 with updates PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • National and international cyber agencies including the U.S. NSA and CERT-EU urged immediate patching or taking services offline because the flaws permit remote code execution and can expose memory-held data.
  • Several European governments and institutions temporarily disconnected public websites as a precaution, with major outages reported in the Netherlands, Germany, France, Finland and other states.
  • Security firms said the bugs were found and analyzed using AI tools and that vendors observed early exploit probes after the patches were published but had not confirmed large-scale successful exploitation.
  • Site operators were told to identify PHP versions, install the official patches or isolate affected systems and to pay special attention to shared hosting and end-of-life PHP branches that may need vendor backports or migration.