PHP issues emergency fixes for two critical unauthenticated remote code execution flaws
With no complete mitigation available, patch speed is the only effective control. The exposure extends well beyond in-house web servers to managed hosting, container base images and vendor products that bundle PHP, where version visibility is often poor. Security leaders should confirm patched versions across all supported branches, and treat any estate on a branch not covered by these releases as an urgent migration case.
What Happened
On 21 October 2026 the PHP development team released PHP 8.5.12, a security release that fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both of which can allow unauthenticated remote code execution. The project said no complete mitigations exist and that updating is the only safe choice. Snyk reports that PHP 8.4.27, 8.3.36 and 8.2.35 were released at the same time, that both flaws are rated CVSS v4.0 9.2, and that the PHP security team gave advance notice of the release on 20 October.
Why It Matters
With no complete mitigation available, patch speed is the only effective control. The exposure extends well beyond in-house web servers to managed hosting, container base images and vendor products that bundle PHP, where version visibility is often poor. Security leaders should confirm patched versions across all supported branches, and treat any estate on a branch not covered by these releases as an urgent migration case.
Sources
- PHP Foundation (opens in a new tab): [PHP] PHP 8.5.12 Released (2026-10-21)
- Snyk (opens in a new tab): PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now (2026-10-21)
More From This Briefing
- Railway breach exposes customer secrets in suspected campaign targeting AI inference providers
- Anthropic previews Claude Duet, a proactive agent for professionals and small businesses
- Insurers increasingly cast as key capital source for AI data centres and chip plants
- Arbol launches parametric cover against government moratoriums on data centre construction
This story is part of the Laurenceo Intelligence briefing for 23 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.