The PHP development team has released PHP 8.2.35, an immediate security update addressing two critical vulnerabilities that can allow unauthenticated remote code execution. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect a vast portion of the internet, as PHP powers a majority of websites and web applications worldwide.
The release, announced on GitHub, was tagged with a verified signature, and the urgency of the update reflects the severity of the flaws. Because the vulnerabilities enable unauthenticated attackers to execute arbitrary code on vulnerable servers, system administrators are urged to upgrade immediately.
PHP 8.2.35 Security Fixes: What Are CVE-2026-109618 and CVE-2026-109619?
CVE-2026-109618 and CVE-2026-109619 are described as critical security issues that permit unauthenticated remote code execution. While the full technical details are still emerging, the potential impact is immense: successful exploitation could give attackers complete control over affected servers, leading to data theft, ransomware deployment, or use in botnet armies.
The vulnerabilities affect PHP 8.2 and possibly other supported branches. The PHP team has not yet released patches for other versions, but updates for 8.3 and 8.4 are expected to follow. Users on older, unsupported versions are especially at risk and should consider migrating to a supported release as soon as possible.
Why This PHP Vulnerability Affects a Huge Share of the Internet
PHP is the backbone of popular content management systems like WordPress, Joomla, and Drupal, as well as countless custom web applications. This widespread adoption means the flaws could be exploited on a massive scale. Security researchers have dubbed the situation "PHP Armageddon," warning that automated scanning and exploitation attempts are likely already underway.
