duke42 Security scan & fix Ongoing care
← Back to Duke42

PHP REPAIR & SECURITY

Patch PHP. Keep your site running.

We check the PHP runtime behind your website, apply the right security fixes and test your site afterwards.

See recent security issues ↓

One-time repair

FIX NOW

Previously €199 Now €99 / one-time repair

PHP packages and configuration · Backup · Runtime update · Pages, forms and logs

Money-back guarantee. If we can’t fix your problem, we’ll refund your payment in full. Prices in EUR; VAT added where applicable.

FREE WEBSITE CHECK

Find your website’s security risks

Recent security issues

8 selected records

24 Jul 2026 – 24 Oct 2026 · Sources checked 24 Oct 2026

Selected PHP runtime advisories and security-release fixes. Vendor backports can change whether a package is affected. This is a selected list, not a complete vulnerability inventory or a scan of your system.

Published

CVE-2026-115560

Session upload progress: a separate RCE scenario

An unusual session configuration can expose a code-execution path.

Affected systems & fix
Applies to
Session upload progress enabled, with a serializer changed from php_binary or php_serialize to php at runtime before session_start().
What fixes it
PHP recommends disabling session upload progress pending the next regular release. The October 21 releases do not fix this separate issue.
Official source ↗
Published

CVE-2026-109618

Code execution through memory corruption

Out-of-memory handling can leave request data unsafe to clean up.

Affected systems & fix
Applies to
Unpatched PHP installations serving web requests. Exploitability depends on the runtime and configuration.
What fixes it
October fixes: 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a verified vendor backport.
Official source ↗
Published

CVE-2026-109619

Code execution through stale request state

A worker may reuse internal state after its memory has been freed.

Affected systems & fix
Applies to
Unpatched PHP installations serving web requests. Exploitability depends on the runtime and configuration.
What fixes it
October fixes: 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a verified vendor backport.
Official source ↗
Security release

CVE-2026-91768

FastCGI IPv6 access-list bypass

Partial address comparison can bypass listen.allowed_clients.

Affected systems & fix
Applies to
Affected PHP branches and the relevant FPM or OpenSSL code paths; match the vendor package to the advisory.
What fixes it
Included in the September security releases. Use the applicable October security release or a later vendor-supported fix.
Official source ↗
Security release

CVE-2026-91769

TLS hostname verification bypass

Certificate hostname checking can fall back to the common name after a SAN mismatch.

Affected systems & fix
Applies to
Affected PHP branches and the relevant FPM or OpenSSL code paths; match the vendor package to the advisory.
What fixes it
Included in the September security releases. Use the applicable October security release or a later vendor-supported fix.
Official source ↗
Security release

CVE-2026-91767

Certificate wildcard buffer overflow

A crafted certificate common name can trigger a heap buffer overflow.

Affected systems & fix
Applies to
Affected PHP branches and the relevant FPM or OpenSSL code paths; match the vendor package to the advisory.
What fixes it
Included in the September security releases. Use the applicable October security release or a later vendor-supported fix.
Official source ↗
Security release

CVE-2026-17544

BCMath out-of-bounds write

The bccomp() implementation could write outside its buffer.

Affected systems & fix
Applies to
Affected PHP packages using the relevant extension.
What fixes it
July security fixes are included in subsequent patched branches; install a current supported security build.
Official source ↗
Security release

CVE-2026-17543

PostgreSQL escaping SQL injection

A backslash breakout could bypass escaping in the PostgreSQL extension.

Affected systems & fix
Applies to
Affected PHP packages using the relevant extension.
What fixes it
July security fixes are included in subsequent patched branches; install a current supported security build.
Official source ↗

Not sure which issues affect you?

Send the site or server address and a working contact. We’ll check the installed versions and configuration before making changes. Missing access? Tell us what you have.

Keep it maintained afterwards. Care from €29/month ↗

LET’S GET IT WORKING

What happened?

Tell us what happened and how to reach you. We’ll arrange access separately — don’t share passwords here.

Can’t access it or don’t know the address? You can still ask for help.

Use another email or your phone if your website’s email is down.

Add details or available access optional

We’ll use your details to respond to this request. Access credentials are arranged separately.