PHP fixes two critical unauthenticated RCE vulnerabilities; updating is the only complete remedy

PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two vulnerabilities that can allow unauthenticated remote code execution. The advisory covers PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Why it matters: The captured PHP and CSA sources do not say how the vulnerabilities were discovered; treat this as a patching and dependency-inventory task. PHP says updating is the only complete solution. Its interim measures reduce exposure to specific paths but do not make an installation safe. Singapore’s CSA advises identifying PHP wherever it runs, including inside third-party applications or components, and prioritizing internet-facing systems.