PHP urges immediate updates for two critical remote-code-execution flaws
PHP’s October 21 advisory announces security updates for two vulnerabilities that can let an unauthenticated attacker run code on a web server.
What the record says
PHP’s October 21 advisory announces versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution.
The project says the flaws affect PHP installations serving web requests and identifies Apache mod_php as the highest-risk configuration.
PHP urges immediate updates. Administrators using distribution packages should consult their vendor for patched builds; older branches may require vendor support or an upgrade.
The advisory says temporary mitigations do not provide a complete solution.
Source details and supporting locations.
Practical next step
Website and server administrators should consult PHP’s advisory and their hosting or package vendor promptly.
Limits and what is not established
The advisory establishes a vulnerability and available fixes, not that a particular website has been attacked. Hosting arrangements and vendor backports can affect which update is appropriate. Consult the official advisory rather than applying unreviewed configuration changes.
Sources checked October 21, 2026. Later notices may change instructions or arrangements.
Original sources
PHP project: original information