The PHP project issued patches Oct. 21 for two critical flaws carrying remote-code-execution risk on affected servers, directing attention to installations that process web requests.
CVE-2026-109618 and CVE-2026-109619 each received a 9.2 rating on version 4.0 of the Common Vulnerability Scoring System (CVSS). The corrected releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both scores place the vulnerabilities in the critical range.
PHP highlighted installations that process web requests, with Apache’s mod_php configuration requiring particular attention. PHP is common in web development; crypto operations that depend on it should check their installations.
SlowMist, a crypto security firm, asked organizations running PHP to map where it is used across their systems and prepare to apply the fixes.
The project also published patches for older PHP releases, including versions 7.4, 8.0 and 8.1, which no longer receive regular security updates from PHP. The source patches give operators on those unsupported branches a fix for these flaws.
