Security
16 min read
PHP's October 2026 Critical RCEs: CVE-2026-109618 and CVE-2026-109619
PHP fixed two critical (CVSS 9.2) unauthenticated RCEs in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Proofs of concept are circulating: patch every PHP server now.
Atlas Security
Security Advisories
