Oct 22, 2026
4 min readPHP 8.1 and older got no fix for today's critical PHP RCEs. What to do.
PHP fixed two unauthenticated RCEs, CVE-2026-109618 and CVE-2026-109619, in 8.2 through 8.5 only. If you run PHP 8.1, 8.0, 7.x, or 5.x, here are your options.
By Sean O'Dea