Update to php ≥ 8.5.12 and/or php-legacy ≥ 8.3.36 to prevent remote code execution

T2Covered by 1 source · first reported by OMG! Ubuntu / It's FOSS News / 9to5Linux / Fedora Magazine / Ubuntu Blog / Arch News / Debian News at 21 Oct, 13:58 UTC

PHP versions prior to 8.5.12 and 8.3.36 are affected by CVE-2026-109618 and CVE-2026-109619, which allow for remote code execution. For any system publicly exposing a PHP application with the help of a prior version of PHP, we urge users to upgrade those systems to the latest available version of…

devsecurity

Sources

• T2Update to php ≥ 8.5.12 and/or php-legacy ≥ 8.3.36 to prevent remote code executionOMG! Ubuntu / It's FOSS News / 9to5Linux / Fedora Magazine / Ubuntu Blog / Arch News / Debian News21 Oct, 13:58

Vulnerabilities

• CVE-2026-109618
• CVE-2026-109619