Summary

PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We…

For more information, read the full story at the original source: Schneier on Security ↗

Vulnerabilities in this story

• CVE-2026-109618 KEV · fix by 2026-10-29 PHP Group PHP, Siemens AMIS TS, Siemens Energy Engage EPSS 99.9% 9.2Critical
• CVE-2026-109619 KEV · fix by 2026-10-29 PHP Group PHP, Siemens AMIS TS, Siemens Energy Engage EPSS 99.9% 9.2Critical

Also reported by

• Krebs on Security: Widespread PHP Flaw May Cause Many Site Outages Today ↗