PHP Vulnerability October 2026: CVE-2026-109618 & CVE-2026-109619 Explained (and How to Patch)
Two critical unauthenticated RCE flaws, CVE-2026-109618 and CVE-2026-109619, were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Who’s affected, how to check, and what to do today.