PHP users must update their systems immediately to address two critical unauthenticated RCE vulnerabilities.

PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, urging all PHP users to update; all web-serving deployments are affected (PHP) https://www.php.net/archive/2026.php#2026-10-21-5 http://www.techmeme.com/261021/p29#a261021p29

Major Web Site Security Alert! PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update immediately. CISA POST: "CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. " https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching #Security #CISA #PHP #CVE #php2shell #SecurityPatch #SecurityAdvisory #Software #Risk #RemoteCodeExecution #RCE #WebSites #Internet #Web #WWW #CyberSecurity #CyberDefence