> Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619)

[SOURCE] Sucuri Blog [AUTHOR: Sucuri Malware Research Team] [DATE: 21/10/2026 21:12] [LANGUAGE: EN]

Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated attackers to execute code on affected web servers. Both carry a CVSS v4.0 score of 9.2, and exploitation attempts are already being observed in the wild.
PHP has released the following fixed versions:
PHP branch
Fixed version
PHP 8.5
8.5.12
PHP 8.4
8.4.27
PHP 8.3
8.3.36
PHP 8.2
8.2.35
If you manage your own server or VPS, install the appropriate update immediately.
Continue reading Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619) at Sucuri Blog.

[messages.read_original_source] →