critical vulnerabilities

Patch trackers

Critical vulnerabilities in the runtimes and tools developers depend on, with vendor-by-vendor patch status, fixed versions and a paste-in self-check.

PHP runtime · disclosed 2026-10-21 · updated 2026-10-22

PHP2Shell: CVE-2026-109618, CVE-2026-109619

Two unauthenticated remote code execution flaws in the PHP runtime itself, not in any one application. Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Critical · CVSS v4.0 9.2Fixed: 18Partially fixed: 17Mitigation only: 7Update PHP itself: 6No statement yet: 1