PHP Releases Patches for Two Critical Flaws as Websites Are Urged to Update
The developers of PHP, a programming language widely used to build websites, have released updated versions to fix two critical security vulnerabilities. The new releases, made in October 2026, are versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to PHP's archive page.
The two flaws are identified as CVE-2026-109618 and CVE-2026-109619. A CVE number is a standard code that lets software makers and security teams refer to the same weakness by one name. PHP said the vulnerabilities could allow unauthenticated remote code execution, meaning an attacker could run commands on an affected server without logging in (PHP).
A Cisco security advisory said the PHP vulnerabilities affect Cisco products. The advisory described CVE-2026-109618 as remote code execution via OOM corruption.
Cybersecurity agencies in several countries urged PHP users to update immediately or to take their websites offline until patches could be applied, Reuters reported. ENISA, the European Union's cybersecurity agency, published a joint statement on the flaws.
The impact has been visible in government services. Dutch government websites went offline on Wednesday amid hacking fears linked to the vulnerabilities, Sky News reported.
Officials said all PHP versions from PHP 5 onward could be affected, according to the Herald. PHP's releases page carries a security notice reading "Critical remote code execution vulnerabilities, update now." The page also lists the previous round of releases, 8.5.11, 8.4.26, 8.3.35 and 8.2.34, which came out on 24 September 2026. PHP says older releases are listed for archival purposes only and are no longer supported.
