Two Critical RCEs in PHP: CVE-2026-109618 and CVE-2026-109619
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two vulnerabilities that can allow unauthenticated remote code execution. How they work, who is at risk, how to check your server, and the official mitigations until you can update.
11 min read · #php #security #server #cve
