Is your PHP server one bad request away from a takeover? 🚨
The UK's NCSC just flagged two critical PHP bugs (CVE-2026-109618 and CVE-2026-109619). An out-of-memory condition can corrupt memory and, under certain conditions, let an attacker run code on your server without logging in. Every version of PHP is affected, not just old ones.
My quick checklist:
✅ Find every PHP install, internet-facing ones first
✅ Update to the latest fixed PHP release
✅ Check bundled apps and appliances that ship PHP
✅ Can't patch yet? Apply the PHP team's temporary mitigations or take the system offline
Laravel and PHP folks: have you patched yet, or is there that one legacy box nobody wants to touch? 👇
Source: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php