Historical technology archive
PHP security release advisory
From CDG’s Oct 22 company post: PHP's October 21 security release fixes CVE-2026-109618 and CVE-2026-109619 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The vulnerabilities can allow remote code execution…
- Original LinkedIn publication
- Added to CDG website
- Historical LinkedIn post checked
- Official source review
- Current claims not revalidated
Original company post
Critical PHP fixes are available. Check the runtime behind your web applications.
PHP's October 21 security release fixes CVE-2026-109618 and CVE-2026-109619 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The vulnerabilities can allow remote code execution without authentication.
CERT-EU advisory 2026-018 warns that PHP installations serving web requests are at risk, including software that embeds PHP even when its presence is not obvious.
For federal technology teams and suppliers: • Inventory PHP runtimes and bundled dependencies, including vendor-managed systems. • Apply the appropriate vendor update and verify the running version, prioritizing internet-facing assets. • If immediate patching is not feasible, CERT-EU recommends considering isolation of internet-facing resources until the fix is applied and verified.
PHP 8.1 and older lack upstream maintenance; some distribution and LTS vendors provide backported fixes. Confirm your vendor's status or move to a supported branch. Temporary mitigations do not fully fix these flaws.
Official advisory: https://lnkd.in/e5cC3dEp PHP release and update instructions: https://lnkd.in/enzbyafj
Illustrative archival photo: Columbia supercomputer, 2006, Trower/NASA, U.S. public domain; cropped. It does not depict an affected PHP system or imply endorsement. https://lnkd.in/ebu64uUF
#VulnerabilityManagement #FederalIT #CyberDefenseGroup