PHP issued updates Oct. 21 for two critical vulnerabilities that put web servers at risk of remote code execution, potentially allowing malicious actors to run commands on affected systems.
The flaws are CVE-2026-109618 and CVE-2026-109619. Each received a score of 9.2 out of 10 under version 4.0 of the Common Vulnerability Scoring System (CVSS). The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The CVEs are the same vulnerabilities covered in an earlier report on PHP's critical flaws.
PHP set its emergency release target for 10 a.m. ET (14:00 UTC) on Oct. 21.
PHP powers websites using platforms such as WordPress and Drupal, along with business sites and control panels. The project advised administrators to review installations that process web requests, especially those using Apache's mod_php configuration.
PHP also released patches for unsupported 7.4, 8.0 and 8.1 branches, which no longer receive regular security updates. The project has scheduled the end of security support for PHP 8.2 for Dec. 31, 2026.
