Skip to the stories
Friday, 23 October 2026
Saved

Next edition

18:35

Headlines

Bugs and Patches

PHP releases emergency patches for two critical remote code execution flaws

The PHP project has released security updates to fix two critical vulnerabilities that allow unauthenticated remote code execution.

FTMQ Security, written by our newsroom0 views

Share

The PHP project released emergency security updates on Wednesday, October 21, 2026, at 14:00 UTC to address two critical vulnerabilities. Snyk and OX Security reported that the flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2. The security issues allow unauthenticated attackers to achieve remote code execution on vulnerable systems. [1][7]

According to Snyk, the fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The vulnerabilities reside directly in the PHP runtime rather than in Composer packages, impacting deployments that serve web requests such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. [1]

The security team at PHP stated that there are no complete workarounds or mitigations available, making updating the only safe option. Administrators running older, unsupported versions such as PHP 8.1 must obtain backported packages from their operating system distribution or long term support providers. [1]

Share

In short

  • PHP fixed two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
  • Both vulnerabilities carry a CVSS v4.0 rating of 9.2 and permit unauthenticated remote code execution.
  • The official patches were released in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • The PHP security team stated that updating is the only safe choice as no complete mitigations exist.

Sources

Every paragraph above points to the numbered items it rests on. Read the originals here.

  1. [1]PHP fixes two critical unauthenticated RCE flawsSnyk, 11h ago (the report this story comes from)
  2. [2]Critical PHP RCE Flaws Prompt Emergency Patches and Forum Shutdowns · cyber.hendryadrian.comHowl.link, 19h ago
  3. [3]Wiz Researchers Detail PHP Memory-Safety Flaws Enabling Unauthenticated RCE · cyber.hendryadrian.comHowl.link, 23h ago
  4. [4]PHP Releases Emergency Patches for Two Critical PHP2Shell RCE Flaws · cyber.hendryadrian.comHowl.link, 1d ago
  5. [5]PHP Patches Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge · cyber.hendryadrian.comHowl.link, 23h ago
  6. [6]PHP Emergency Update Fixes Two Critical RCE Flaws; PHP2Shell Exploit Reported · cyber.hendryadrian.comHowl.link, 1d ago
  7. [7]CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHPOX Security, 1d ago
  8. [8]Alert! PHP preparing to address pair of Critical RCE vulnerabilitiesCyber Daily, 2d ago
  9. [9]PHP Security Releases Fix Two Critical RCE VulnerabilitiesLaravel News, 1d ago
  10. [10]PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News, 1d ago
  11. [11]PHP Releases Emergency Patches for Two Critical RCE FlawsRTMWorld, 16h ago

Background

  1. [12]Cisco patches 34 security vulnerabilities across multiple enterprise product lines FTMQ Security, 17h ago

Our newsroom writes these reports with the help of software, from the 12 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.

Related from FTMQ Security

Earlier reports of ours on the same people and subjects.

More in Bugs and Patches

Get the day in one email

Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.

By signing up you agree to our terms and privacy policy. Unsubscribe any time.

Comments

Loading

Join the conversation

Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.

Already on the list? Enter the same address and we will send a sign-in link.

By signing up you agree to our terms and privacy policy. Unsubscribe any time.