Update to php ≥ 8.5.12 and/or php-legacy ≥ 8.3.36 to prevent remote code execution
Key points
Arch Linux has published a security notice: PHP versions older than 8.5.12 and 8.3.36 contain two vulnerabilities that allow remote code execution. Users running publicly reachable PHP applications on an older version are told to upgrade without delay.
Vulnerabilities
- CVE-2026-109618 and CVE-2026-109619 both permit remote code execution.
- Affected are
phpreleases before 8.5.12 andphp-legacyreleases before 8.3.36.
What to do
- Any system that exposes a PHP application to the public on an affected version should be upgraded right away.
- Fixed versions:
php8.5.12 or later andphp-legacy8.3.36 or later. - Further details and instructions are in the Arch Linux Security Advisories ASA-202610-1 and ASA-202610-2.
- Notice dated 2026-10-21, posted by David Runge.
Summary by DistroNews, based on the original post.
PHP versions prior to 8.5.12 and 8.3.36 are affected by CVE-2026-109618 and CVE-2026-109619, which allow for remote code execution. For any system publicly exposing a PHP application with the help of a prior version of PHP, we urge users to upgrade those systems to the latest available version of PHP (php ≥ 8.5.12 and php-legacy ≥ 8.3.36) immediately.
This is the summary Arch Linux News published with the story. The full text is on the original page.
Read the original at archlinux.org