Off-topic for aiqbench
This story was gathered from a source we follow but falls outside AI and quantum coverage, so there is no aiqbench take for it.
PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): [Updated for CVE-2026-115560]
Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a vendor backport for older versions.
On Wednesday, October 21, 2026 at 14:00 UTC, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, both rated CVSS v4.0 9.2, that can allow unauthenticated remote code execution. The PHP security team advises: "There are no complete mitigations; updating is the only safe choice." These are bugs in the PHP runtime, not in a Composer package. That changes how you detect and fix them, as we explain below TL;DR If you run PHP that serves web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed), update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 today. If you are on 8.1 or older, get a backported package from your distribution or LTS vendor, or upgrade. Times are in UTC. October 20: The PHP security team published an advance notice of a critical security release scheduled for October 21 at 14:00 UTC. It fixes two vulnerabilities assessed as CVSS v4.0 9.2, with the right reserved to release early if details leak or exploitation is seen in the wild. October 20: The PHP security team published an advance notice of a critical security release scheduled for October 21 at 14:00 UTC. It fixes two vulnerabilities assessed as CVSS v4.0…
Excerpt shown under the publisher's RSS terms · 200 words · full text and figures are on the publisher's site