Two critical PHP remote code execution (RCE) vulnerabilities have been disclosed: CVE-2026-109618 and CVE-2026-109619. Both issues affect the php-src component and carry a CVSS v4.0 score of 9.2 (Critical).
Affected PHP versions
According to the provided matrix, the following PHP 8.x branches are vulnerable:
- PHP < 8.2.35
- PHP < 8.3.36
- PHP < 8.4.27
- PHP < 8.5.12
Any installation running a version below these thresholds is within the impact range of the two RCE flaws.
Patched releases and mitigation
The corresponding patched versions are:
- 8.2.35
- 8.3.36
- 8.4.27
- 8.5.12
The text clearly states that you should update PHP to the patched release for your branch immediately (whichever matches your current 8.x series). It also notes that the update is the only complete mitigation for both vulnerabilities.
For environments still on older PHP branches (< 8.1), the PHP security team has provided minimal source backports for PHP 7.4, 8.0, and 8.1 to assist those who build from source. These are described as minimal backports, not a full replacement for upgrading.
Embedded web interfaces, IoT dashboards, and backend services that rely on PHP should verify their current 8.x version and move to the listed patched release as the primary defense against CVE-2026-109618 and CVE-2026-109619.
Source: Gündəm · success.trendmicro.com
