The hero gets the bill

说明与用途

PHP 8.5+ 发现关键漏洞，允许未经身份验证的代码执行。补丁已发布，但分发延迟导致容器暂时暴露。

问题

PHP 8.5+ servers were vulnerable to two critical CVEs (CVE-2026-109618 & CVE-2026-109619) that allowed unauthenticated code execution via memory‑limit exploitation, causing sites to go offline.

结果

After the patch, PHP sites stopped crashing due to memory_limit overflows and were protected from remote code execution. However, coordination delays caused some container images to remain vulnerable for hours.

工作流

• Identify PHP version and memory_limit setting
• Check for CVE-2026-109618/109619 advisories
• Upgrade to patched PHP release
• Verify upgrade by testing memory_limit behavior
• Monitor site stability and logs

证据

Both rated 9.2 out of 10, both allowing someone with no account and no credentials to run their own code on a PHP server.

来源

The fix shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and it's a big one: 300 files and nearly eleven thousand added lines

来源

The official PHP image on Docker Hub has over 1.38 billion pulls

来源