decrypted · 21 october 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

PHP's two critical flaws, and the question of where you run it

PHP, the language behind a very large share of the web, shipped emergency releases today for two critical flaws, CVE-2026-109618 and CVE-2026-109619. Either can allow unauthenticated remote code execution (RCE), meaning a stranger runs commands on your web server without logging in. The NCSC said today that organisations using any version of PHP are affected. The patches exist; the hard part is the gap between a patch and a patched estate.

How the bug works

Picture a restaurant where each waiter carries one tray per customer. When the kitchen runs out of space mid-order, PHP's emergency routine, according to its advisory, abandons the tray half-prepared. Clearing the table then trusts the tray was set out properly. It was not, so a careful attacker can arrange for the leftovers to be their own instructions. That is the first flaw, a memory shortage handled badly. In effect, the server's own housekeeping becomes the attacker's tool.

The second is a cousin: state left over from one request survives after its memory is freed and is reused by the next request on the same worker. In plain terms, one careless request poisons the next. PHP rates both 9.2 on the zero-to-ten CVSS severity scale (version 4.0). It validated full exploitation over HTTP against mod_php, where PHP runs inside the web server, and reports a lab exploit for the second flaw against FPM, the other common mode.

What defenders see

The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Neither PHP nor the NCSC claims confirmed attacks in the wild. BleepingComputer reports that Cloudflare's chief technology officer said attacks were already under way before the patches landed; we have not verified that, so treat it as a claim.

PHP says there are no complete mitigations and updating is the only safe choice. Temporary measures such as disabling session upload progress are only partial. A web application firewall (WAF), a filter in front of a website, may buy time.

The Secure by Design lesson

The deeper problem is visibility. Many organisations cannot say where PHP runs: the intranet, the appliance that bundles it, the supplier's portal. The flaws sit in the runtime itself, so a perfectly written application inherits them. The NCSC's advice starts with finding every PHP system, internet-facing first, and watching for updates from vendors whose products embed it. If you cannot update, it says consider taking the system offline, and failing that, check for backdoors with an NCSC-assured incident response provider.

Secure by Design here means three decisions made before the emergency. Keep an inventory that includes bundled components, not just software bought by name. Require suppliers by contract to tell you within hours which runtimes they ship and when they have patched. Build a web tier you can take out of service without a board meeting. Rehearse that once. None is costly in a quiet week; all are dearer to invent at midnight. Opinion, not advice.

Also this week

SafePay ransomware. A joint advisory published on 20 October by the FBI, CISA and the US Secret Service, with the NCA and the North West Regional Organised Crime Unit among the partners, says SafePay has hit at least 600 victims across critical infrastructure sectors. Initial access came through exposed credentials, brute-forced passwords, VPN access and internet-facing edge devices. The advisory names five CVEs dating from 2020 to 2024, which is a polite way of saying old flaws still pay. The advice is unglamorous: patch exposed systems first, require multi-factor authentication (MFA), a second check on top of the password, lock accounts after repeated failed logins, and keep offline, immutable backups you have actually restored from. It also recommends restricting command-line and scripting permissions, and watching for lateral movement with endpoint detection and response (EDR), security software that watches laptops and servers. None of it is exotic: a gang does not need your newest flaw while your oldest still works.

DeepSeek removed from US federal agencies. The US Department of Homeland Security has ordered DeepSeek products out of federal civilian agencies, including third-party products "developed using" them, according to BleepingComputer and The Register. Agencies can seek exceptions within 60 days. It is not a consumer ban, and The Register notes it is unclear how far that wording reaches, since AI gateways can route to DeepSeek by default. We have not read the order itself, so this rests on press reports. The UK lesson is not geopolitical: ask your suppliers which AI models sit behind their features, and where your data goes when they are called. That is a procurement question, and it is cheaper to ask before a regulator or a headline does. Practically, it means one extra line in a supplier questionnaire: which model providers do you call, and will you tell us if that changes?

Sources