Prepared by the Nadali editorial team using AI
On October 21, 2026, the PHP team released 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The official PHP notice says they can allow remote code execution without authentication. The team urges immediate updates.
Who should pay attention
Owners of shops, hotels, restaurants and other businesses whose websites handle web requests through PHP. Do not guess the technology from the appearance of a page: ask whoever manages the hosting.
PHP says all installations serving web requests are at risk, with the highest risk attributed to Apache with mod_php. Interim measures do not replace fixes. For packages with backported fixes, check the vendor’s notice rather than relying on the version number alone.
Where AI fits
OpenAI reports that Calif researchers found one vulnerability using GPT-5.6 Sol, while Wiz independently discovered both. PHP’s maintainers led the fixes and release. This attributes the research contribution; it does not establish the security of any particular business website.
Three questions for your contractor
Our editorial recommendation: request a short answer with evidence, not a general assurance that everything is updated.
- Does our production website use PHP, and which package actually handles requests?
- Have fixes for both named CVEs been installed? Please provide the vendor’s notice and the time they were applied.
- Have the main workflows been checked after the change: enquiries, bookings or orders, where the website supports them?
Agree on a backup and recovery plan with the responsible administrator. Do not copy random server settings or treat a working homepage as a complete test. If the host has not applied the fixes yet, request a specific plan and deadline; a specialist should assess interim protections against the official guidance.
Bottom line and limitations
The useful outcome for an owner is confirmation that the required fix is running on their website, with its key workflows checked. Nadali has not inspected your server and is not establishing that a breach occurred. Updating also does not prove there was no earlier compromise.
Related: prepare a manual fallback for workflow failures.
Sources checked on October 21, 2026. Cover: original AI-generated illustration, not an incident photograph or a test result.
