Critical PHP Vulnerabilities Allow Remote Code Execution, Emergency Fixes Released
PHP releases emergency security updates addressing two critical vulnerabilities that could allow unauthenticated remote code execution on affected servers.
LinuxiacENPHP
✦ Supernova
LinuxiacEN
PHP ships emergency patches for critical PHP2Shell flaws
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
Arch Linux NewsDevUpdate to php ≥ 8.5.12 and/or php-legacy ≥ 8.3.36 to prevent remote code execution
PHP versions prior to 8.5.12 and 8.3.36 are affected by CVE-2026-109618 and CVE-2026-109619, which allow for remote code execution.
LWN.netDevPHP patches released for two critical RCEs
The PHP project has published PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address two cri
LWN.netEN
PhoronixDevPHP Updates Released For Two Critical Code Execution Vulnerabilities
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were just released to fix two critical vulnerabilities that can allow for unauthenticated remote code execution
PhoronixENLWN.netDevCritical PHP security update coming
The PHP security team has let it be known that there is a high-stakes security update coming at 14:00 UTC on October 21. "All PHP users are encouraged to prepare now so they can upgrade as soon as …
LWN.netEN
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked …