PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619
The PHP Foundation details the release of security updates for PHP versions 8.2 through 8.5 to fix two critical memory management and error handling vulnerabilities. The post explores the history of these bugs, the recent external security audit, and the challenges of patching core components without breaking ecosystem compatibility.
Why it matters
These critical vulnerabilities affect a massive portion of web servers globally, making immediate patching essential to prevent unauthenticated remote code execution attacks.
Who we are What we do News Talks Contact php.net Sponsor The PHP Foundation Who we are What we do News Talks Contact Sponsor Today's PHP Security Release, and How We're Strengthening PHP Security Published on Oct 21, 2026 The PHP Foundation News Security Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now. The announcement on php.net contains and references technical details on the vulnerabilities, attack vectors, and instructions on how to update on which systems.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in