Overview
- PHP Foundation published emergency updates on Wednesday that fix two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 and include releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Both flaws carry a 9.2 CVSS v4.0 score and allow unauthenticated remote code execution, meaning attackers can run code on vulnerable servers without logging in.
- Researchers describe CVE-2026-109618 as an out-of-memory memory‑corruption bug and CVE-2026-109619 as a use-after-free error, each capable of leading to reliable server takeover.
- CERT-EU and Australia’s ACSC urged immediate patching or temporary takedowns where updates cannot be applied and hosting firms warned of data theft, site defacement, or full compromise.
- OpenAI, Calif and Wiz coordinated a roughly two-month remediation, released tools to help operators identify affected versions, and warned the same AI methods that found these bugs could be used to speed exploit development.