PHP has released fixes for two critical flaws rated 9.2, while Kraken's security chief warns that embedded PHP can leave overlooked devices dependent on vendor updates.

PHP released fixes on Oct. 21 for two critical vulnerabilities that can let unauthenticated attackers run code on web servers, as crypto security executives urged operators to patch and check overlooked infrastructure.

The PHP team's security advisory identifies CVE-2026-109618 and CVE-2026-109619, following its Oct. 20 advance warning. Both have a critical CVSS v4.0 severity score of 9.2 out of 10.

The fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The project says all PHP installations serving web requests are at risk, with the highest risk in Apache's mod_php: a demonstrated exploit can run before application code begins.

CVE-2026-109618 involves unsafe cleanup after an out-of-memory error. CVE-2026-109619 involves stale internal state reused across requests.

The flaws are known as PHP2Shell. Cloudflare said it observed attack traffic targeting customers and attackers changing payloads to try to bypass its protections.

The threat has drawn warnings from senior security officials at Kraken and hardware wallet manufacturer Ledger, highlighting the risks that vulnerabilities in widely used software pose to cryptocurrency businesses and their supporting infrastructure.

The emergency coincides with separate security fixes for Node.js and the compromise of eight internet authentication certificates, putting pressure on operators to review the software and services that underpin their applications.

Kraken Chief Security Officer Nick Percoco warned that organizations must act quickly to secure internet-facing PHP installations, citing Cloudflare's detection of emerging attacks.

Source link