{"id":"php-news-180b24ab7a3e","seq":301,"kind":"release","title":"Security advisory: Critical remote code execution vulnerabilities, update now","url":"https://www.php.net/index.php#2026-10-21-5","permalink":"https://vulnpulse.app/items/php-news-180b24ab7a3e","summary":"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. Who is at risk: The vulnerabilities: , CVE-2026-109618 (): out-of-memory handling can interrupt PHP while internal request data is onl…","severity":"critical","techs":["php"],"cves":["CVE-2026-109618"],"tags":["security"],"source":{"id":"php-news","name":"PHP News"},"published_at":"2026-10-21T00:35:26.000Z","fetched_at":"2026-10-21T16:17:45.625Z"}