PHP has released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities have a critical CVSS v4.0 rating of 9.2. They let unauthenticated attackers run code remotely on any PHP installation that serves web requests. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk is highest for mod_php, where a demonstrated exploit fires before any application code runs.
Read our vulnerability blog post for the full details and update guidance.
Using Lansweeper Sites? Follow the instructions in the blog post to see vulnerable assets in your site.
Select Top 1000000 Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As
icon,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblState.Statename As State,
tsysAssetTypes.AssetTypename As AssetType,
Coalesce(tsysOS.OSname, tblLinuxSystem.OSRelease) As OS,
tblAssets.IPAddress,
tsysIPLocations.IPLocation,
Case X.TierNo
When 1 Then '1 - PHP runtime found'
When 2 Then '2 - Possible PHP host'
Else '3 - IIS, PHP unlikely'
End As Tier,
X.Category,
X.Source,
X.Package,
X.Items As [Matching items],
Case X.SapiRank
When 6 Then 'Apache mod_php - highest risk'
When 5 Then 'FrankenPHP - high risk'
When 4 Then 'php-cgi'
When 3 Then 'PHP-FPM'
When 2 Then 'LiteSpeed LSAPI'
When 1 Then 'Core / CLI only'
Else ''
End As [How PHP runs],
X.RawVersion As [Detected version],
Case
When X.Maj Is Not Null Then Cast(X.Maj As varchar(5)) + '.' +
IsNull(Cast(X.VMin As varchar(5)), 'x') + '.' + IsNull(Cast(X.Pat As
varchar(5)), 'x')
Else ''
End As [PHP version],
Case X.StatusCode
When 1 Then 'Vulnerable - unsupported branch (<= 8.1), no official fix'
When 2 Then 'Vulnerable'
When 3 Then 'Not vulnerable'
When 4 Then 'Verify - PHP 8.6 pre-release'
When 5 Then 'Unknown patch level - verify manually'
When 0 Then 'Unknown version - verify manually'
Else 'No PHP runtime seen - verify host'
End As Status,
Case
When X.StatusCode = 1 Then 'Upgrade to 8.2.35+ (or vendor backport)'
When X.StatusCode = 2 Then 'Update to ' + Case X.VMin
When 2 Then '8.2.35'
When 3 Then '8.3.36'
When 4 Then '8.4.27'
Else '8.5.12'
End
When X.StatusCode In (0, 5) Then
'Check the real version (php -v / package changelog)'
When X.StatusCode = 4 Then 'Use 8.6.0 RC4 or later - not for production'
When X.StatusCode = 3 Then ''
When X.Category = 'Web server' Then
'Check for PHP modules/handlers (php -v)'
When X.Category = 'Container host' Then 'Check container images for PHP'
When X.Category = 'IIS web server' Then
'Check IIS handler mappings for php-cgi.exe'
When X.Category = 'Appliance (PHP-based web UI)' Then
'Check the vendor advisory / firmware'
Else 'Find the PHP runtime serving this application'
End As Action,
Case
When X.TierNo = 1 And X.Platform = 'Linux' Then
'Distro packages may carry a backported fix under an older version number - check the distro advisory'
Else ''
End As Note,
X.Detail,
tblAssets.Lastseen As [Last successful scan],
Case
When X.StatusCode In (1, 2) Then '#ffadad'
When X.StatusCode In (0, 4, 5) Then '#ffd152'
When X.StatusCode = 3 Then '#d4f4be'
When X.TierNo = 2 Then '#fff3c4'
Else '#ffffff'
End As backgroundcolor
From (Select G.*,
Case
When G.TierNo > 1 Then 9
When G.Maj Is Null Or G.VMin Is Null Then 0
When G.Maj < 8 Or (G.Maj = 8 And G.VMin <= 1) Then 1
When G.Maj = 8 And G.VMin >= 6 Then 4
When G.Maj > 8 Then 4
When G.Pat Is Null Then 5
When (G.Maj = 8 And G.VMin = 2 And G.Pat < 35) Or
(G.Maj = 8 And G.VMin = 3 And G.Pat < 36) Or
(G.Maj = 8 And G.VMin = 4 And G.Pat < 27) Or
(G.Maj = 8 And G.VMin = 5 And G.Pat < 12) Then 2
Else 3
End As StatusCode
From (Select W.AssetID,
W.TierNo,
W.Category,
W.Source,
W.Platform,
W.Maj,
W.VMin,
W.Pat,
Min(W.Package) As Package,
Count(*) As Items,
Max(W.RawVersion) As RawVersion,
Max(W.Detail) As Detail,
Max(W.SapiRank) As SapiRank
From (Select V.*,
Coalesce(Case
When V.Dots Between 1 And 3 Then Try_Cast(ParseName(V.CleanVer,
V.Dots + 1) As int)
End, Try_Cast(V.NameMaj As int)) As Maj,
Coalesce(Case
When V.Dots Between 1 And 3 Then Try_Cast(ParseName(V.CleanVer,
V.Dots) As int)
End, Try_Cast(V.NameMin As int)) As VMin,
Case
When V.Dots Between 2 And 3 Then Try_Cast(ParseName(V.CleanVer,
V.Dots - 1) As int)
End As Pat,
Case
When V.TierNo = 1 Then ''
Else V.Package
End As GroupPkg
From (Select C.*,
Len(C.CleanVer) - Len(Replace(C.CleanVer, '.', '')) As Dots
From (Select C0.*,
Case
When C0.TierNo = 1 Then Left(C0.NoEpoch,
PatIndex('%[^0-9.]%', C0.NoEpoch + 'x') - 1)
Else ''
End As CleanVer
From (Select S.AssetID,
S.Platform,
S.Source,
S.Package,
S.RawVersion,
S.Detail,
Coalesce(S.PreCat, Case
When S.Package Like '%xampp%' Or
S.Package Like '%wampserver%' Or
S.Package Like '%laragon%' Then 'PHP bundle'
When S.Package Like '%phpmyadmin%' Or
S.Package Like 'wordpress%' Or
S.Package Like '%nextcloud%' Or
S.Package Like '%owncloud%' Or
S.Package Like 'drupal%' Or
S.Package Like 'joomla%' Or
S.Package Like 'zabbix-frontend%' Or
S.Package Like 'librenms%' Or
S.Package In ('composer', 'cacti', 'glpi',
'roundcube', 'roundcubemail', 'mediawiki',
'moodle', 'matomo') Then 'PHP application'
When S.Package In ('php', 'PHP', 'php-cli',
'php-common', 'php-fpm', 'php-cgi',
'php-litespeed', 'php-embedded', 'mod_php') Or
S.Package Like 'php[5-9]' Or
S.Package Like 'php[5-9]-cli' Or
S.Package Like 'php[5-9]-fpm' Or
S.Package Like 'php[5-9].[0-9]' Or
S.Package Like 'php[5-9].[0-9]-cli' Or
S.Package Like 'php[5-9].[0-9]-common' Or
S.Package Like 'php[5-9].[0-9]-fpm' Or
S.Package Like 'php[5-9].[0-9]-cgi' Or
S.Package Like 'php[5-9][0-9]' Or
S.Package Like 'php[5-9][0-9]-common' Or
S.Package Like 'php[5-9][0-9]-fpm' Or
S.Package Like 'php[5-9][0-9]-php-common' Or
S.Package Like 'php[5-9][0-9]-php-cli' Or
S.Package Like 'php[5-9][0-9]-php-fpm' Or
S.Package Like 'libapache2-mod-php%' Or
S.Package Like 'apache2-mod_php%' Or
S.Package Like 'lsphp[5-9][0-9]' Or
S.Package Like 'PHP [0-9]%' Or
S.Package Like 'frankenphp%' Then 'PHP runtime'
When S.Package In ('apache2', 'apache2-bin',
'httpd', 'nginx', 'nginx-core', 'nginx-full',
'openlitespeed', 'lsws', 'lighttpd', 'caddy') Or
S.Package Like 'Apache HTTP Server%' Then
'Web server'
When S.Package In ('docker-ce', 'docker.io',
'docker', 'podman', 'containerd', 'containerd.io',
'moby-engine') Or
S.Package Like 'Docker Desktop%' Then
'Container host'
End) As Category,
Case
When S.PreCat = 'IIS web server' Then 3
When S.PreCat = 'PHP runtime' Then 1
When S.PreCat Is Not Null Then 2
When S.Package Like '%xampp%' Or
S.Package Like '%wampserver%' Or
S.Package Like '%laragon%' Then 1
When S.Package Like '%phpmyadmin%' Or
S.Package Like 'zabbix-frontend%' Then 2
When S.Package In ('php', 'PHP', 'php-cli',
'php-common', 'php-fpm', 'php-cgi',
'php-litespeed', 'php-embedded', 'mod_php') Or
S.Package Like 'php[5-9]' Or
S.Package Like 'php[5-9]-cli' Or
S.Package Like 'php[5-9]-fpm' Or
S.Package Like 'php[5-9].[0-9]' Or
S.Package Like 'php[5-9].[0-9]-cli' Or
S.Package Like 'php[5-9].[0-9]-common' Or
S.Package Like 'php[5-9].[0-9]-fpm' Or
S.Package Like 'php[5-9].[0-9]-cgi' Or
S.Package Like 'php[5-9][0-9]' Or
S.Package Like 'php[5-9][0-9]-common' Or
S.Package Like 'php[5-9][0-9]-fpm' Or
S.Package Like 'php[5-9][0-9]-php-common' Or
S.Package Like 'php[5-9][0-9]-php-cli' Or
S.Package Like 'php[5-9][0-9]-php-fpm' Or
S.Package Like 'libapache2-mod-php%' Or
S.Package Like 'apache2-mod_php%' Or
S.Package Like 'lsphp[5-9][0-9]' Or
S.Package Like 'PHP [0-9]%' Or
S.Package Like 'frankenphp%' Then 1
Else 2
End As TierNo,
Coalesce(S.PreSapi, Case
When S.Package Like 'libapache2-mod-php%' Or
S.Package Like 'apache2-mod_php%' Or
S.Package = 'mod_php' Then 6
When S.Package Like 'frankenphp%' Then 5
When S.Package Like 'php%cgi%' Then 4
When S.Package Like 'php%fpm%' Then 3
When S.Package Like 'lsphp%' Or
S.Package Like 'php%litespeed%' Then 2
When S.Package Like 'php%' Or
S.Package Like 'PHP%' Then 1
Else 0
End) As SapiRank,
Case
When S.Package Like 'lsphp[5-9][0-9]%' Then
SubString(S.Package, 6, 1)
When S.Package Like 'php[5-9].[0-9]%' Or
S.Package Like 'php[5-9][0-9]%' Then
SubString(S.Package, 4, 1)
When S.Package Like 'PHP [5-9].[0-9]%' Then
SubString(S.Package, 5, 1)
End As NameMaj,
Case
When S.Package Like 'lsphp[5-9][0-9]%' Then
SubString(S.Package, 7, 1)
When S.Package Like 'php[5-9].[0-9]%' Then
SubString(S.Package, 6, 1)
When S.Package Like 'php[5-9][0-9]%' Then
SubString(S.Package, 5, 1)
When S.Package Like 'PHP [5-9].[0-9]%' Then
SubString(S.Package, 7, 1)
End As NameMin,
Case
When CharIndex(':', IsNull(S.RawVersion, '')) > 0
Then SubString(S.RawVersion, CharIndex(':',
S.RawVersion) + 1, 200)
Else IsNull(S.RawVersion, '')
End As NoEpoch
From (Select tblLinuxSoftware.AssetID,
Cast('Linux' As nvarchar(20)) As Platform,
Cast('Linux package' As nvarchar(50)) As Source,
Cast(tblSoftwareUni.softwareName As nvarchar(400))
As Package,
Cast(LTrim(RTrim(tblLinuxSoftware.Version)) As
nvarchar(200)) As RawVersion,
Cast(Null As nvarchar(400)) As Detail,
Cast(Null As nvarchar(100)) As PreCat,
Cast(Null As int) As PreSapi
From tblLinuxSoftware
Inner Join tblSoftwareUni On
tblSoftwareUni.SoftID =
tblLinuxSoftware.SoftwareUniID
Where (tblSoftwareUni.softwareName Like '%php%' Or
tblSoftwareUni.softwareName Like '%nextcloud%'
Or tblSoftwareUni.softwareName Like '%owncloud%'
Or tblSoftwareUni.softwareName Like 'wordpress%'
Or tblSoftwareUni.softwareName Like 'drupal%' Or
tblSoftwareUni.softwareName Like 'joomla%' Or
tblSoftwareUni.softwareName Like 'librenms%' Or
tblSoftwareUni.softwareName In ('apache2',
'apache2-bin', 'httpd', 'nginx', 'nginx-core',
'nginx-full', 'openlitespeed', 'lsws',
'lighttpd', 'caddy', 'docker-ce', 'docker.io',
'docker', 'podman', 'containerd',
'containerd.io', 'moby-engine', 'composer',
'cacti', 'glpi', 'roundcube', 'roundcubemail',
'mediawiki', 'moodle', 'matomo'))
Union All
Select tblSoftware.AssetID,
'Windows',
'Windows software',
tblSoftwareUni.softwareName,
LTrim(RTrim(tblSoftware.softwareVersion)),
Null,
Case
When tblSoftwareUni.SoftwarePublisher Like
'%PHP Group%' Then 'PHP runtime'
End,
Null
From tblSoftware
Inner Join tblSoftwareUni On
tblSoftwareUni.SoftID = tblSoftware.softID
Where ((tblSoftwareUni.softwareName = 'PHP' Or
tblSoftwareUni.softwareName Like 'PHP [0-9]%'
Or tblSoftwareUni.softwareName Like '%XAMPP%'
Or tblSoftwareUni.softwareName Like
'%WampServer%' Or
tblSoftwareUni.softwareName Like '%Laragon%'
Or tblSoftwareUni.softwareName Like
'Apache HTTP Server%' Or
tblSoftwareUni.softwareName Like
'Docker Desktop%')) Or
(tblSoftwareUni.softwareName Like 'PHP%'
And tblSoftwareUni.SoftwarePublisher Like
'%PHP Group%')
Union All
Select tblMacApplications.AssetID,
'Mac',
'Mac application',
tblSoftwareUni.softwareName,
LTrim(RTrim(tblMacApplications.Version)),
tblMacApplications.Path,
Null,
Null
From tblMacApplications
Inner Join tblSoftwareUni On
tblSoftwareUni.SoftID =
tblMacApplications.softid
Where (tblSoftwareUni.softwareName Like '%XAMPP%' Or
tblSoftwareUni.softwareName Like
'Docker Desktop%' Or
tblSoftwareUni.softwareName Like 'frankenphp%'
Or tblSoftwareUni.softwareName Like
'PHP [0-9]%')
Union All
Select tblFileVersions.AssetID,
'Windows',
'Windows file scan',
tblFileVersions.FilePathfull,
LTrim(RTrim(tblFileVersions.FileVersion)),
tblFileVersions.FilePathfull,
'PHP runtime',
Case
When tblFileVersions.FilePathfull Like
'%\php[5-9]apache2[_.]%' Then 6
When tblFileVersions.FilePathfull Like
'%\php-cgi.exe' Then 4
Else 1
End
From tblFileVersions
Where (tblFileVersions.FilePathfull Like '%\php.exe'
Or tblFileVersions.FilePathfull Like
'%\php-cgi.exe' Or
tblFileVersions.FilePathfull Like
'%\php[5-9]ts.dll' Or
tblFileVersions.FilePathfull Like
'%\php[5-9].dll' Or
tblFileVersions.FilePathfull Like
'%\php[5-9]apache2[_.]%') And
tblFileVersions.Found = 1
Union All
Select tblServices.AssetID,
'Windows',
'Windows service',
IsNull(tblServicesUni.Caption,
tblServicesUni.Name),
Null,
tblServicesUni.Pathname,
Case
When tblServicesUni.Pathname Like '%php%' Or
tblServicesUni.Name Like '%php%' Then
'PHP runtime'
When tblServicesUni.Name = 'W3SVC' Then
'IIS web server'
Else 'Web server'
End,
Case
When tblServicesUni.Pathname Like '%php-cgi%'
Then 4
When tblServicesUni.Pathname Like '%fpm%' Then 3
When tblServicesUni.Pathname Like '%php%' Or
tblServicesUni.Name Like '%php%' Then 1
End
From tblServices
Inner Join tblServicesUni On
tblServicesUni.ServiceuniqueID =
tblServices.ServiceuniqueID
Where ((tblServicesUni.Name = 'W3SVC' Or
tblServicesUni.Name Like '%php%')) Or
(tblServicesUni.Pathname Like '%php%') Or
(tblServicesUni.Pathname Like '%httpd.exe%') Or
(tblServicesUni.Pathname Like '%nginx%') Or
(tblServicesUni.Pathname Like '%xampp%') Or
(tblServicesUni.Pathname Like '%wamp%') Or
(tblServicesUni.Pathname Like '%laragon%') Or
(tblServicesUni.Pathname Like '%litespeed%') Or
(tblServicesUni.Pathname Like '%caddy%')
Union All
Select tblAssetCustom.AssetID,
'Appliance',
'Asset manufacturer/model',
LTrim(IsNull(tblAssetCustom.Manufacturer, '') +
' ' + IsNull(tblAssetCustom.Model, '')),
Null,
Null,
'Appliance (PHP-based web UI)',
Null
From tblAssetCustom
Where ((tblAssetCustom.Manufacturer Like '%QNAP%' Or
tblAssetCustom.Manufacturer Like '%Synology%'
Or tblAssetCustom.Manufacturer Like
'%Netgate%' Or tblAssetCustom.Manufacturer
Like '%Deciso%')) Or
(tblAssetCustom.Model Like '%pfSense%') Or
(tblAssetCustom.Model Like '%OPNsense%')
Union All
Select tblAssetCustom.AssetID,
'Web',
'HTTP title',
tblAssetCustom.HTTPTitle,
Null,
Null,
'PHP application (web title)',
Null
From tblAssetCustom
Where (tblAssetCustom.HTTPTitle Like '%phpMyAdmin%'
Or tblAssetCustom.HTTPTitle Like '%WordPress%'
Or tblAssetCustom.HTTPTitle Like '%Nextcloud%'
Or tblAssetCustom.HTTPTitle Like '%Roundcube%'
Or tblAssetCustom.HTTPTitle Like '%GLPI%' Or
tblAssetCustom.HTTPTitle Like '%Zabbix%' Or
tblAssetCustom.HTTPTitle Like '%Moodle%' Or
tblAssetCustom.HTTPTitle Like '%pfSense%')) As
S) As C0
Where C0.Category Is Not Null) As C
Where Not (C.Package = 'php-common' And CharIndex('.',
C.CleanVer) = 0)) As V) As W
Group By W.AssetID,
W.TierNo,
W.Category,
W.Source,
W.Platform,
W.GroupPkg,
W.Maj,
W.VMin,
W.Pat) As G) As X
Inner Join tblAssets On tblAssets.AssetID = X.AssetID
Inner Join tblAssetCustom On tblAssetCustom.AssetID = tblAssets.AssetID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tblState On tblState.State = tblAssetCustom.State
Left Join tsysIPLocations On tsysIPLocations.LocationID = tblAssets.LocationID
Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Left Join tblLinuxSystem On tblLinuxSystem.AssetID = tblAssets.AssetID
Where tblState.Statename = 'Active'
Order By X.TierNo,
X.StatusCode,
tblAssets.AssetName
Explore Lansweeper for free.
No credit card required.