{"id":4551,"date":"2026-10-22T09:13:56","date_gmt":"2026-10-22T06:13:56","guid":{"rendered":"https:\/\/www.govcert.bg\/?p=4551"},"modified":"2026-10-22T09:15:38","modified_gmt":"2026-10-22T06:15:38","slug":"critical-vunerabilities-php","status":"publish","type":"post","link":"https:\/\/www.govcert.bg\/en\/warnings\/critical-vunerabilities-php\/","title":{"rendered":"\u041a\u0440\u0438\u0442\u0438\u0447\u043d\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 PHP"},"content":{"rendered":"<p>\u041e\u0442 PHP \u043e\u0431\u044f\u0432\u0438\u0445\u0430, 2 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044a\u0432 PHP, \u043a\u043e\u0438\u0442\u043e \u0431\u0438\u0445\u0430 \u043c\u043e\u0433\u043b\u0438 \u0434\u0430 \u0434\u043e\u0432\u0435\u0434\u0430\u0442 \u0434\u043e remote code execution.<\/p>\n<p>\u041d\u0430 21.10.2026 PHP \u043f\u0443\u0441\u043d\u0430\u0445\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0437\u0430 PHP, \u0432\u044a\u0432 \u0432\u0435\u0440\u0441\u0438\u0438 8.5.12, 8.4.27, 8.3.36 \u0438 8.2.35.<\/p>\n<p>\u041e\u0431\u044f\u0432\u0435\u043d\u0438\u0442\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0430:<\/p>\n<p><strong>CVE-2026-109618<\/strong> (GHSA-w8hw-w9fx-j79w) \u0441 CVSS 9.2, \u043a\u043e\u044f\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0430 remote code execution, \u0447\u0440\u0435\u0437 memory corruption during out-of-memory (OOM) handling<\/p>\n<p><strong>CVE-2026-109619<\/strong> (GHSA-6wmf-4rv5-p3rp), \u0441 CVSS 9.2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0430\u0449\u0430 remote code execution \u0447\u0440\u0435\u0437 stale global state.<\/p>\n<p>\u0417\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\u0442\u0435 \u0438\u043c\u0430 \u043d\u0430\u043b\u0438\u0447\u043d\u0438 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0438 \u0435\u043a\u0441\u043f\u043e\u0439\u0442\u0438.<\/p>\n<p>\u0417\u0430\u0441\u0435\u0433\u043d\u0430\u0442\u0438 \u0432\u0435\u0440\u0441\u0438\u0438:<\/p>\n<p><strong>Affected Products<\/strong><\/p>\n<ul>\n<li>PHP 8.5 \u0432\u0435\u0440\u0441\u0438\u0438\u0442\u0435 \u043f\u0440\u0435\u0434\u0438 8.5.12<\/li>\n<li>PHP 8.4 \u0432\u0435\u0440\u0441\u0438\u0438\u0442\u0435 \u043f\u0440\u0435\u0434\u0438 8.4.27<\/li>\n<li>PHP 8.3 \u0432\u0435\u0440\u0441\u0438\u0438\u0442\u0435 \u043f\u0440\u0435\u0434\u0438 8.3.36<\/li>\n<li>PHP 8.2 \u0432\u0435\u0440\u0441\u0438\u0438\u0442\u0435 \u043f\u0440\u0435\u0434\u0438 8.2.35<\/li>\n<li>End-of-life \u0432\u0435\u0440\u0441\u0438\u0438 (PHP 8.1 \u0438 \u043f\u043e-\u0441\u0442\u0430\u0440\u0438), \u043a\u043e\u0438\u0442\u043e \u043d\u044f\u043c\u0430 \u0434\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442 \u0430\u043a\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442 PHP.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>CERT \u0411\u044a\u043b\u0433\u0430\u0440\u0438\u044f \u0432\u0438 \u043f\u0440\u0435\u043f\u043e\u0440\u044a\u0447\u0432\u0430 \u0434\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u0438\u0437\u0438\u0440\u0430\u0442\u0435 \u0438\u043d\u0441\u0442\u0430\u043b\u0438\u0440\u0430\u043d\u0438\u0442\u0435 \u043e\u0442 \u0412\u0430\u0441 \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0430 PHP.<\/p>\n<p>For more information:<\/p>\n<p><a href=\"https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018\">https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018<\/a><\/p>\n<p><a href=\"https:\/\/www.enisa.europa.eu\/news\/joint-statement-on-critical-php-vulnerabilities\">https:\/\/www.enisa.europa.eu\/news\/joint-statement-on-critical-php-vulnerabilities<\/a><\/p>\n<p><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1\">https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1<\/a><\/p>\n<p><a href=\"https:\/\/www.php.net\/index.php#2026-10-20-1\">https:\/\/www.php.net\/index.php#2026-10-20-1<\/a><\/p>\n<p><a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-w8hw-w9fx-j79w\">https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-w8hw-w9fx-j79w<\/a><\/p>\n<p><a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-6wmf-4rv5-p3rp\">https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-6wmf-4rv5-p3rp<\/a><\/p>\n<p>&nbsp;<\/p>","protected":false},"excerpt":{"rendered":"<p>\u041e\u0442 PHP \u043e\u0431\u044f\u0432\u0438\u0445\u0430, 2 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044a\u0432 PHP, \u043a\u043e\u0438\u0442\u043e \u0431\u0438\u0445\u0430 \u043c\u043e\u0433\u043b\u0438 \u0434\u0430 \u0434\u043e\u0432\u0435\u0434\u0430\u0442 \u0434\u043e remote code execution. \u041d\u0430 21.10.2026 PHP \u043f\u0443\u0441\u043d\u0430\u0445\u0430 \u0430\u043a\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0437\u0430 PHP, \u0432\u044a\u0432 \u0432\u0435\u0440\u0441\u0438\u0438 8.5.12, 8.4.27, 8.3.36 \u0438 8.2.35. \u041e\u0431\u044f\u0432\u0435\u043d\u0438\u0442\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0430: CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) \u0441 CVSS 9.2, \u043a\u043e\u044f\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0430 remote code execution, \u0447\u0440\u0435\u0437 memory corruption during out-of-memory (OOM) handling CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), \u0441 CVSS &#8230; <a title=\"\u041a\u0440\u0438\u0442\u0438\u0447\u043d\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 PHP\" class=\"read-more\" href=\"https:\/\/www.govcert.bg\/en\/warnings\/critical-vunerabilities-php\/\" aria-label=\"More on \u041a\u0440\u0438\u0442\u0438\u0447\u043d\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 PHP\">Read more<\/a><\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[44],"tags":[],"class_list":["post-4551","post","type-post","status-publish","format-standard","hentry","category-warnings"],"_links":{"self":[{"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/posts\/4551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/comments?post=4551"}],"version-history":[{"count":3,"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/posts\/4551\/revisions"}],"predecessor-version":[{"id":4554,"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/posts\/4551\/revisions\/4554"}],"wp:attachment":[{"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/media?parent=4551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/categories?post=4551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.govcert.bg\/en\/wp-json\/wp\/v2\/tags?post=4551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}