On 21 October 2026, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They allow an unauthenticated attacker to remotely execute arbitrary PHP code on a web server. All PHP versions from 5.4 onwards are affected, including end-of-life branches (8.1 and older), which will ...