News
PHP releases emergency fixes for two exploited zero‑day vulnerabilities
PHP patched CVE‑2026‑109618 and CVE‑2026‑109619, which allowed remote code execution, denial‑of‑service and data exposure on versions 5.4+. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Cloudflare deployed WAF rules and government sites experienced outages.