Patch

PHP Ships Emergency Fixes for CVE-2026-109618 and CVE-2026-109619

PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix two critical remote code execution flaws. The advisories confirm what the warning left open: which setups are at risk, how the bugs work, and what to do if you cannot update today.