PHP's two critical RCE fixes: the bug wasn't new, the decision was stuck
php
dev.to
On October 21, 2026 the PHP project shipped emergency releases for two critical remote-code-execution bugs in the language runtime itself. The headline most outlets chose is "AI found it". The more useful part is what the PHP Foundation says about why it took so long to fix. What happened (facts) Releases. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per the php.net advisory. PHP says there are no complete mitigations: updating is the only safe choice. The bugs. CVE-2026-109618 (out-of-