The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The PHP project says all PHP users are strongly encouraged to update immediately. We recommend making sure every site you manage is running a patched version of PHP as soon as possible.
Remote code execution means an attacker could run their own code on your server. “Unauthenticated” means they would not need to log in first. In its advance notice on October 20, the PHP security team rated both vulnerabilities 9.2 on the CVSS
