CRITICAL PHP RCE VULNERABILITIES: PATCH NOW (CVE-2026-109618, CVE-2026-109619)

Summary from the TLDR DevOps newsletter

Two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21. Proof-of-concept exploit code is available, and the flaws affect every PHP version from PHP 5 onward. DigitalOcean is automatically patching WordPress instances on its Cloudways managed product, but customers running PHP on Droplets or other unmanaged services must update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 immediately. There are no patches for PHP 8.1 or earlier.