PHP Patches Two Critical RCE Flaws; Web Operators Urged to Update
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. Temporary measures do not fully remove risk.
PHP’s development team released security updates on October 21, 2026 for two critical flaws that can allow unauthenticated remote code execution: CVE-2026-109618 and CVE-2026-109619. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Follow OrangeX.com Security.
Web-serving installations in scope
The official advisory covers PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It identifies mod_php as the highest-risk configuration, with a demonstrated attack before application code runs.
PHP says updating is the complete solution; temporary measures only reduce specific attack paths. Operators using distribution packages should check vendor fixes. Older branches need vendor support or migration to a supported release. More coverage is available in OrangeX.com News.
OrangeX.com Analysis
Crypto businesses running affected PHP web infrastructure have reason to review their deployments. This is a server-software advisory, not evidence that a named exchange, wallet or blockchain has been breached. A published patch also does not show that every operator has deployed it. Verification resources are available in the OrangeX.com Trust Center.
Related Reports
Node.js Security Updates Fix Brotli Flaw Across Three Release Lines
Node.js lists 26.12.1, 24.22.1 and 22.23.4 as security releases. Exposure to the high-severity Brotli flaw depends on an application’s handling of compressed input.
Electrum 4.8.3 Fixes Malicious-Server Fee-Bump Attack; Users Urged to Upgrade
An October 24 advisory covers versions before 4.8.3. Loss requires signing the altered transaction; check full destination addresses and amounts.
CISA and FBI Warn of SafePay Ransomware, Citing at Least 600 Victims Since 2024
The October 20 joint warning highlights exposed credentials, internet-facing systems and backup disruption; its victim count is not specific to crypto businesses.
