The PHP development team has shipped emergency security releases to patch two critical vulnerabilities that allow unauthenticated remote code execution. The fixes land in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering every supported branch of the language that powers a large share of the web.
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both were rated CVSS v4.0 9.2 in the team's advance notice. The PHP security team says it is no longer waiting: evidence of exploitation is now in the wild, and the advisory warns that no complete mitigation exists. Updating is the only safe option.
Who is at risk from CVE-2026-109618 and CVE-2026-109619
The advisory is unusually broad. It covers all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. If a server runs PHP and answers requests from the internet, it belongs on the patched list.
The PHP team flags mod_php as the highest-risk setup. In a demonstrated exploit, an unauthenticated request can trigger the attack before any application code runs. That means a vulnerable server can be compromised even if the site's own code is clean.
- PHP-FPM
- Apache with mod_php (highest risk)
- php-cgi
- FrankenPHP
