On 21 October 2026, the PHP security team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The issues can allow remote code execution without a login on affected web-facing PHP installations.
The official advisory says updating is the complete remedy. Temporary configuration measures may reduce exposure to particular attack paths, but they are not a substitute for an appropriate security update.
PHP is used beneath many websites and online services. A small business may rely on a hosting company or external developer to maintain that layer and may not know which version is installed. Not every website uses PHP, so checking the actual technology matters.
Why it matters
Why it matters: security work is easiest to miss when responsibility is unclear. A website owner should be able to identify who handles server updates, how urgent advisories are reviewed and how completion is confirmed.
A practical message to a hosting provider or site maintainer is: Does our site use PHP? Which version is running? Are the relevant fixes or supported vendor backports installed? Who will confirm the update and check that the site still works?
Source: PHP Project. This page contains Aegean Astraea’s own summary and commentary; the original article is not republished here.
Read the original source ↗