PHP pushes emergency security patches for critical unauthenticated RCE flaws affecting up to 70% of websites

PHP has released emergency security patches for two critical remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP 5 through 8.5, rated CVSS 9.2. The flaws require no authentication and affect as many as 70% of the world's websites, including WordPress and government and e-commerce sites. Patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The patch was pushed a day early after details leaked online.

Detected & updated continuously · Source: Nebula