Note: All CourseVector managed websites have been updated to resolve the vulnerabilities detailed below.
What is PHP and why is it so important?
PHP is a server side programming language that powers about 70% of all websites on the internet. It is the backbone to popular frameworks like WordPress, Laravel, and many others. Imagine your website is a busy restaurant. The code (HTML & CSS) is the dining room, decorations, and the menu. Its what the customer (user) interacts with. The database is the storage where all of the raw ingredients are held. For a website, this includes things like user data, images, and blog posts. PHP is the kitchen staff. Users click a page (order an item), they don’t go retrieve the ingredients and make the item themselves. Instead, PHP (the kitchen staff) handles gathering the ingredients, cooking the meal, plating, and handing it back to the waiter to deliver to the customer. Without PHP, the internet as we know it today would be unable to function. Just like a restaurant would fail without its amazing kitchen staff.
How is PHP Vulnerable?
2 major bugs were found within core PHP recently. PHP released a news article detailing the situation and resolutions. These vulnerabilities are labelled as critical level vulnerabilities. These are so dangerous because it can allow attackers to compromise entire web servers without a login. It also bypasses security plugins on common platforms. Below are details on the two vulnerabilites and how they relate back to our restaurant analogy:
The “Out of Memory” Trick (CVE-2026-109618):
- Imagine the kitchen staff has a limited number of plates. An attacker orders a meal so massive that the staff runs out of plates halfway through (an “Out of Memory” error). When the staff scrambles to clean up the mess, they accidentally read a set of hidden instructions the attacker slipped into the order, running malicious commands in the process.
The “Ghost Order” Trick (CVE-2026-109619):
- The kitchen staff uses the same notepad for multiple orders. If an order fails, they are supposed to erase the notepad. This bug happens because they forget to erase it. A new, seemingly innocent order comes in, but the staff accidentally reads leftover, malicious instructions from the previous failed order (this is a “stale state” or “use-after-free” bug).
Who Is Affected?
Any website running an outdated version of PHP. If your website is running a supported version of PHP, the security patches are already released and available to the public. The real danger zone is websites on EOL (end-of-life) versions of PHP. These versions no longer receive security updates and will remain vulnerable. Please refer to PHP’s support versions post for more information on your version of PHP.
What Should Website Owners Do?
If you manage your own server & website, please check your current PHP version and apply the necessary updates. Refer to PHP’s latest news post for more information.
If you use managed hosting, contact your web host immediately to confirm that the critical 10/21 PHP patches have been applied.
All CourseVector managed websites have been updated to resolve the vulnerabilities detailed above.
