GoKawiilPHP patches two critical RCE flaws in 8.5.12, 8.4.27, 8.3.36 and 8.2.35
The PHP project has released updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let unauthenticated attackers achieve remote code execution. The flaws stem from out-of-memory handling and stale global state issues affecting PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed deployments. PHP versions 8.1 and earlier no longer receive official fixes, so users on those versions must seek vendor backports or upgrade.