Wire · regulatory
PHP fixes two critical unauthenticated RCE flaws
◆ Sectors
◆ Source
◆ Verified
Fusion42 · 23 October 2026 · Fusion42 review
On October 21, 2026, the PHP project released security updates for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix two critical unauthenticated remote code execution vulnerabilities, both rated CVSS 9.2. Older PHP versions no longer supported require backported patches or upgrading to avoid severe risks.
This Wire brief sits within Fusion42's coverage of Developer Tools.
◆ ◆ The Wire takeaway
A critical PHP runtime flaw opens all web servers using vulnerable PHP to remote code attacks with no complete workaround. You must push security updates immediately or risk compromise through fundamental server code.
◆ Coverage
1 source · 23 Oct 2026
◆ Related on Wire
◆ Topics