https://walterstein.eu/en/security-alerts/ In-depth articles on current vulnerabilities: why they are dangerous, who is affected and how to fix them. en https://walterstein.eu/en/security-alerts/php-cve-2026-109618 https://walterstein.eu/en/security-alerts/php-cve-2026-109618 Wed, 28 Oct 2026 06:00:00 GMT Two flaws in the PHP core let an attacker on the internet run their own code on a server without logging in. They are already being exploited. The only reliable protection is updating PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restarting every PHP process.