Arch Linux has warned about two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. According to the project, they allow remote code execution and affect versions before 8.5.12 and 8.3.36 in the respective branches.
Administrators running publicly exposed PHP applications on affected versions are urged to update immediately. The advisory specifies php 8.5.12 or later and php-legacy 8.3.36 or later. Systems using both packages need to check each one.
Published on October 21, the notice provides actionable update thresholds but does not describe exploitation prerequisites or report observed attacks. The supplied text therefore does not establish which configurations might further limit exposure.
Choose a sign-in method or comment as a guest below.