Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated attackers to execute code on affected web servers. Both carry a CVSS v4.0 score of 9.2, and exploitation attempts are already being observed in the wild.
PHP has released the following fixed versions:
PHP branch
Fixed version
PHP 8.5
8.5.12
PHP 8.4
8.4.27
PHP 8.3
8.3.36
PHP 8.2
8.2.35
If you manage your own server or VPS, install the appropriate update immediately.
Read more: Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)
Story added 21. October 2026, content source with full text you can find at link above.