Details of critical vulnerabilities in PHP have been revealed, and corrective updates have been published.
Corrective releases of PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been published, along with patches for the now unsupported branches PHP 7.4, PHP 8.0, and PHP 8.1 (vulnerable versions from 5.4 to 7.3 remain without patches), which fix two critical vulnerabilities: CVE-2026-109618 — remote code execution caused by exhaustion of available free memory in the process handling […]
