Security2 hOctober 24, 2026, 17:55

No patches for PHP 7.4, 8.0 and 8.1 against critical RCEs

CISA and CERT-EU warned about two remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. Fixes exist only in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while branches 7.4, 8.0 and 8.1 will get no patch. A third flaw, CVE-2026-115560, remains unpatched, with disabling session.upload_progress.enabled as the only mitigation.

DEV Community

Open source

No patches for PHP 7.4, 8.0 and 8.1 against critical RCEs

Two PHP core RCEs rated CVSS 9.2, exploit attempts reported
Patches only in 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Branches 7.4, 8.0 and 8.1 will receive no fix
For CVE-2026-115560 only session.upload_progress.enabled = 0 is available

#PHP#CISA

Next.js patches two critical RCEs and a Server Actions DoS

Security

PHP2Shell: sites on PHP 8.1 and older left without a patch

Security

Interview with the volunteer who maintains PHP and patched two critical flaws

Security

No patches for PHP 7.4, 8.0 and 8.1 against critical RCEs

Next.js patches two critical RCEs and a Server Actions DoS

PHP2Shell: sites on PHP 8.1 and older left without a patch

Interview with the volunteer who maintains PHP and patched two critical flaws

Patches released for critical RCE flaws in PHP, GitLab and Node.js