On October 21, 2026, the PHP Foundation released emergency updates for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2. These flaws allow unauthenticated attackers to execute code at the PHP request-parsing layer before application logic, leading to potential widespread exploitation. Despite the lack of reliable public exploits being confirmed, the PHP Foundation emphasized the urgency of applying the updates, as configuration adjustments alone would not suffice for safety. The vulnerabilities, which affect various PHP versions, underscore the importance of promptly patching internet-facing applications and monitoring logs for signs of compromise

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 Fixes Two Critical PHP RCE

The PHP Foundation released an emergency out-of-band update on October 21, 2026, fixing two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each scored 9.2, that let unauthenticated attackers run code in PHP's native request-parsing layer before any application logic runs. The embargo broke down fast: details leaked to Hacker News ahead of schedule, Cloudflare had already spotted live attacks, and Sansec expects mass exploitation within roughly 15 minutes. PHP's patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the foundation stresses there are no real mitigations, only an update makes you safe, with Apache mod_php being the easiest to weaponize. Analysts note that reliable public exploits remain unproven so far, but the guidance is clear: patch internet-facing PHP first and check logs for signs of compromise.

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 Fixes Two Critical PHP RCE @ Linux Compatible