PHP has released fixes for two flaws in its runtime, the software that executes PHP application code. Both flaws can let attackers run server code without logging in. Known as PHP2Shell, they affect the layer beneath website applications. Updating website plugins alone therefore cannot repair the underlying problem.

Ready to transform artificial intelligence from a buzzword into your personal revenue generator?

HubSpot’s groundbreaking guide "200+ AI-Powered Income Ideas" is your gateway to financial innovation in the digital age.

Inside you'll discover:

Download your guide today and unlock a future where artificial intelligence powers your success. Your next income stream is waiting.

Get Your Guide

One vulnerability, CVE-2026-109618, concerns failures while PHP allocates working memory. The PHP security team describes request data becoming only partly initialized. A failed memory allocation can abruptly stop processing. Cleanup may treat that unfinished data as valid, enabling unsafe memory access. Attackers can exploit this condition to execute code on the server. Ubuntu says execution uses the affected application’s credentials.

For this flaw, the patch changes PHP’s handling of exhausted memory. It delays some interruptions until the engine reaches a safe stopping point. A separate threshold can terminate the process before unsafe cleanup occurs.

PHP’s advisory identifies particular danger in Apache’s mod_php integration. A demonstrated attack can trigger before any application code runs. That places the failure before checks written inside the application. Other deployment methods remain at risk, although the demonstrated attack paths differ. For this flaw, PHP’s analysis identifies PHP-FPM as susceptible, but reports no complete demonstrated exploit for that configuration.

The second flaw, CVE-2026-109619, involves information surviving beyond its valid lifetime. A worker is a server process that handles incoming requests. It can retain references to memory belonging to an earlier request. After that memory is released, a later request may use those references. The exact attack conditions depend on the internal state and configuration.

A fast AI answer isn't always a coordinated one. When AI resolves B2B issues without looping in the teams responsible for them, confidence outpaces alignment. A new Harvard Business Review Analytic Services briefing paper, sponsored by Front, looks at closing that gap.

Read the Briefing Paper

The response extends across countries and different types of operators. The United States NSA, Britain’s NCSC, and Australia’s ACSC issued advisories. Their alerts address the same underlying PHP vulnerabilities across North America, Europe, and Oceania. These alerts do not establish how many websites attackers have successfully compromised.

PHP’s fixed upstream releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. However, distribution packages can carry fixes under different version numbers. Ubuntu’s advisory lists corrected packages across several supported operating system releases. These include older PHP branches maintained through distributor support. A version comparison therefore needs the relevant vendor’s package information. An older version number alone cannot settle whether the fix is present.

Installing corrected files does not automatically replace every running process. Ubuntu explains that applications using PHP may need to restart. Apache running mod_php specifically requires its service to be restarted. Automatic security updates can install packages without completing that operational step. A successful package update therefore leaves another question to verify. The application must actually use the corrected component while serving requests.

The dependency can also sit inside another vendor’s product. Britain’s NCSC highlights appliances and services that bundle PHP. Its guidance calls for identifying these installations and checking supplier updates. For a managed website, the hosting provider may control PHP maintenance. The visible application and its underlying runtime can have different update responsibilities.

Cloudflare says it observed attack traffic targeting these vulnerabilities. It also reports deploying firewall protections using request and response signals. These are observations and protection claims from the company’s own systems. They do not provide a worldwide count of successful compromises. Cloudflare still identifies PHP updates as necessary alongside its firewall protections.

The operational challenge is connecting each application to its running dependencies. That includes the PHP package, its supplier, and any required restart. A corrected release makes repair possible, but deployment determines its reach. The remaining task is verifying which PHP build actually serves requests.

For its first CTV campaign, Jennifer Aniston’s DTC haircare brand LolaVie had a few non-negotiables. The campaign had to be simple. It had to demonstrate measurable impact. And it had to be full-funnel.

LolaVie used Roku Ads Manager to test and optimize creatives — reaching millions of potential customers at all stages of their purchase journeys. Roku Ads Manager helped the brand convey LolaVie’s playful voice while helping drive omnichannel sales across both ecommerce and retail touchpoints.

The campaign included an Action Ad overlay that let viewers shop directly from their TVs by clicking OK on their Roku remote. This guided them to the website to buy LolaVie products.

Discover how Roku Ads Manager helped LolaVie drive big sales and customer growth with self-serve TV ads.

The DTC beauty category is crowded. To break through, Jennifer Aniston’s brand LolaVie, worked with Roku Ads Manager to easily set up, test, and optimize CTV ad creatives. The campaign helped drive a big lift in sales and customer growth, helping LolaVie break through in the crowded beauty category.

Learn more.