PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. The flaws affect web-facing SAPIs and can enable unauthenticated remote code execution, with mod_php considered the highest-risk deployment. …
New reporting on php2shell shows the operational impact: organizations in several countries took government and institutional sites offline after BSI and CISA urged immediate action. Cloudflare counted millions of exploi…
Amazon Web Services detected an attempt to exploit PHP2Shell on October 17, four days before fixes for two PHP vulnerabilities and public reports appeared. The traffic reached an AWS honeypot from an IP tied to a commerc…
Amazon Linux 2023 assigns CVE-2026-109618 and CVE-2026-109619 the status Important, although PHP and other public assessments give both a CVSS v4.0 score of 9.2 and Critical severity. AWS says PHP 8.2 through 8.5 are aff…
PHP's October 21, 2026 security release fixes two critical RCE vulnerabilities, but a new analysis shifts attention to response capability. It covers the patched branches and the SAPI-specific exposure for each flaw, the…
PHP is set to publish an emergency security update on 21 October 2026 at 14:00 UTC for two critical vulnerabilities rated CVSS v4.0 9.2. CERT-EU lists CVE-2026-109618 and CVE-2026-109619 and warns of possible remote code…
On October 21, 2026, PHP released emergency fixes for CVE-2026–109618 and CVE-2026–109619, two critical unauthenticated remote-code-execution flaws rated 9.2 by CVSS v4.0. Fixed branches are PHP 8.5.12, 8.4.27, 8.3.36, a…
FrankenPHP 1.13.2, released on 21 October, is a security update for the PHP application server. Its Docker images and static binaries include PHP versions that address PHP2Shell, two critical flaws enabling unauthenticat…
The Dutch National Cyber Security Centre (NCSC) has taken NCSC.NL offline as a precaution, citing vulnerabilities in PHP. The agency says PHP’s security team expects to publish a patch at 16:00 Dutch time and plans an ad…
An October 21 post describes a reportedly separate PHP vulnerability that produces an AddressSanitizer double-free error in PHP 8.4.25. The author says the behavior was confirmed on PHP 8.5.10 and still worked on 8.5.12.…
A post on r/PHP asks why CloudLinux is listing patches for PHP 7.4 and 8.0 before updates for 8.2 through 8.5. The discussion concerns CVE-2026-109618 and CVE-2026-109619. The author says official PHP security releases b…
Calif Research has published a technical account of CVE-2026-109618 and CVE-2026-109619, which were fixed in PHP’s October 21, 2026 security release. The report, produced with contributions from OpenAI and Wiz, explains …
The PHP project has released new point versions for four branches: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. The release notices provide no changelog or security details.
Laravel published framework v12.70.1 on 21 October as a focused patch for the 12.x branch. The release contains one commit, e09fc54, from pull request #62027 by @valorin. Its change prevents escaping from bypassing prote…
A Hacker News post reports an expected PHP announcement on 22 October 2026 at 18:00 CEST covering two remote-code-execution vulnerabilities with CVSS 10.0 ratings. It names CVE-2026-109618 and CVE-2026-109619. The author…
Symfony 6.4 has reached its 48th patch release, and this week's batch fixed security issues in Yaml and HttpFoundation along with a timezone bug in Clock. Laravel teams usually wait for their own framework to tell them s…
Laravel’s token API guard allowed unauthenticated account access on MySQL and MariaDB when attackers supplied a non-string credential. The flaw carries CVSS 9.2 and is fixed in 12.68.0 and 13.29.0. A separate JSON:API is…
A post in r/PHP identifies CVE-2026-108082 as a Symfony regular-expression denial-of-service issue. It claims that a single request can consume CPU for several seconds. The excerpt names no affected Symfony versions or f…
Laravel 13.38.0, released on 20 October 2026, is a maintenance update for the 13.x branch. It adjusts validation, Eloquent relations, database queries, queues, notifications, logging, caching and lazy collections. The re…
The RFC that deprecated PECL broke nothing and set no deadline, so most of us will leave pecl install where it is. I think that's the wrong move. The gaps in PIE are real but small, and every Dockerfile that switches ear…
RoadRunner 3 is available with a return to Semantic Versioning and a shared roadrunner/* package namespace. The release targets PHP 8.2 and newer, adds several HTTP, jobs, proxy, Redis and gRPC capabilities, and removes …
Symfony’s roundup for October 12 to 18, 2026 reports maintenance work across four release branches and security fixes in Yaml and HttpFoundation. Symfony UX 3.6 adds experimental tools, while the project previews Symfony…
Laravel 13.36, released in October 2026, adds fluent builders for more validation rules and introduces DB::olap() for analytical work on compatible Vitess systems such as PlanetScale. It also changes Mercure delivery def…
The detailed upstream record for FrankenPHP 1.13.0 adds the missing release substance: five security fixes, including two high-severity issues, Caddy 2.11.7, Mercure 1.0, safer configuration reloads, PHP 8.6 compatibilit…
Manticore, an ahead-of-time compiler for PHP 8.5+ with an LLVM backend, can now compile Symfony applications. The milestone covers skeleton projects without Doctrine and simple Symfony Console apps. Its built-in HTTP ser…
