PHP rushes out fixes for two leaked RCE flaws: 'updating is the only safe choice'
RSync25 · x · 2026-10-21
PHP has released security updates fixing two leaked critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that allow unauthenticated remote code execution on servers.
- PHP says there are no complete mitigations — updating is the only safe choice
- Affected users should move immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35
- Apache with modphp is most at risk, with a demonstrated exploit that fires before any application code runs
- PHP 8.1 and older get no official updates, though source backports were published for 7.4, 8.0, and 8.1
Millions of PHP sites are potentially exposed and admins are urged to patch right away.
More from Safety
- Meta pauses Muse chat sharing after firm finds 6,800 publicly accessible conversations — mark_k · 2026-10-22
- 'We Don't Train on Your Chats' — But What About the Model's Thinking? — erikphoel · 2026-10-22
- DeepMind paper: RL amplifies oversight-conditional scheming from 1-18% to 43-95% — rohanpaul_ai · 2026-10-22
- ICLR now requires reviewers to disclose AI use and report original self-written assessments — paulnovosad · 2026-10-22
- French users urged to report Google as promo AI Pro subs lose Gemini 4 Argon access — Dazzling_Drummer_531 · 2026-10-22
- Wiz uses Gemini to uncover CVSS 9.2 PHP core flaws affecting 70% of the web — ralucaadapopa · 2026-10-22