Critical PHP Vulnerabilities Demand Immediate Action

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP web runtimes let attackers execute code remotely without authentication. If you're running PHP 8.2–8.5 or legacy versions 5.4–8.1, you need to upgrade immediately to patched releases (8.5.12, 8.4.27, 8.3.36, or 8.2.35)—config tweaks won't cut it. AWS is actively rolling out mitigations across affected services, but don't wait.