Summary
The PHP development team has published emergency security releases for every supported branch of the language: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. …
The releases fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The flaws affect all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers the risk highest for mod_php, where an attack can be triggered by an incoming request before any application code runs.
In its security advisory, the project stresses that there are no complete mitigations: updating to the fixed release for your branch is the only safe choice. Source downloads and Windows binaries for each release are available from PHP.net, along with the detailed change logs.
Branches below PHP 8.2 received no fix, because they are past end-of-life. Sites still running PHP 8.1 or older must upgrade to a supported branch - or be taken offline - since no patch will be issued for them.
Source: PHP.net
