The hero gets the bill

Описание и применение

В PHP 8.5+ обнаружены критические уязвимости, позволяющие удаленно выполнить код без аутентификации. Патч был выпущен, но задержка в распространении привела к временной уязвимости контейнеров.

Задача

PHP 8.5+ servers were vulnerable to two critical CVEs (CVE-2026-109618 & CVE-2026-109619) that allowed unauthenticated code execution via memory‑limit exploitation, causing sites to go offline.

Результат

After the patch, PHP sites stopped crashing due to memory_limit overflows and were protected from remote code execution. However, coordination delays caused some container images to remain vulnerable for hours.

Рабочий процесс

• Identify PHP version and memory_limit setting
• Check for CVE-2026-109618/109619 advisories
• Upgrade to patched PHP release
• Verify upgrade by testing memory_limit behavior
• Monitor site stability and logs

Доказательства

Both rated 9.2 out of 10, both allowing someone with no account and no credentials to run their own code on a PHP server.

Источник

The fix shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and it's a big one: 300 files and nearly eleven thousand added lines

Источник

The official PHP image on Docker Hub has over 1.38 billion pulls

Источник