PHP has released emergency security patches addressing two critical vulnerabilities that allow remote code execution on servers running popular applications including WordPress, MediaWiki, Magento, Joomla, Laravel, and Drupal.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, pose an immediate threat to web applications built on these platforms. The patches were made available on Wednesday at 11 a.m. Brasília time for PHP 8.x releases. Immediate updates are strongly recommended to prevent potential attacks that could compromise server security and expose sensitive data.