PHP Issues Urgent Patches for Arbitrary Code Execution Flaws
43s
2
14:57, 22.10.2026
Recently, PHP released unplanned updates to address the following vulnerabilities: CVE-2026-109619 and CVE-2026-109618. Both exploits got a CVSS score of 9.2, and potential attackers could run arbitrary code on the server without the need for authentication.
Insights into the revealed vulnerabilities
CVE-2026-109618 is related to improper handling of out-of-memory conditions, while the second is related to using memory after it has been freed. The issues mainly affect PHP interpreters, which means updates to other applications will not solve the problem.
Here is a list of the fixed versions: PHP 8.2.35, 8.3.36, 8.5.12, and 8.4.27. The general recommendation for users of the older versions is to utilize patches provided by the distribution vendor or to switch to the supported version.
Hope you found this article helpful - what do you think? Like and subscribe to our blog to get more practical tips and the latest tech news from HostZealot.
Was this article helpful to you?
Yes
No
VPS popular offers
-10%
Windows
€ 18.65 /mo
Billed annually
-21.4%
Windows
€ 67 /mo
Billed annually
-10%
Linux
€ 16.45 /mo
Billed annually
-10%
Linux
€ 17.38 /mo
Billed annually
-10%
€ 149.04 /mo
Billed annually
-10%
Linux
€ 6.49 /mo
Billed annually
-21.5%
Windows
€ 26 /mo
Billed annually
-10%
Linux
€ 27.85 /mo
Billed annually
-8.4%
Windows
€ 37.4 /mo
Billed annually
-10%
Linux
€ 60.5 /mo
Billed annually
