PHP Officially Urges Users to Update Immediately to Avoid Severe Remote Code Execution Vulnerabilities
Odaily reports: PHP has issued a security advisory regarding two previously disclosed critical remote code execution (RCE) vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Attackers may exploit these vulnerabilities to execute malicious code without authentication, and PHP officially strongly recommends that all users upgrade immediately.These vulnerabilities affect PHP environments that handle web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Among these, Apache mod_php poses a particularly prominent risk, as attacks can be triggered before application code runs.Official patched versions have been released: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users still running PHP 8.1 or earlier should contact their distribution or long-term support (LTS) vendor to confirm patch availability, or upgrade to a supported version. Officials emphasize that temporary mitigation measures cannot fully eliminate the risk—installing security updates immediately is the only complete way to address the vulnerabilities.

