Report
Critical PHP Remote Code Execution Vulnerabilities Patched
PHP maintainers released emergency patches on Oct 21 for two critical RCE flaws (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) affecting PHP 5.x through 8.5.11. Issues enable unauthenticated RCE on web servers. Patches released in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35.
TLDR
PHP powers a significant portion of the internet; these critical flaws affecting multiple versions posed immediate risk to millions of web servers. Leaked pre-patch details prompted early release; pre-patch exploitation attempts were reported. The internet-wide potential impact and high severity make immediate patching urgent across web infrastructure.
Combined views
31.3K
8 Sources, first seen ago
