Technology
PHP CVE-2026-109618 and CVE-2026-109619: how to check your version and patch today
CVE-2026-109618 and CVE-2026-109619 are two critical PHP flaws (CVSS 9.2) that allow unauthenticated remote code execution. They affect PHP 8.2, 8.3, 8.4 and 8.5 below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released on 21 October 2026. The only complete fix is to update and restart every PHP worker.