github.comadvisoryPHP 8.2.35
PHP 8.2.35 is a security release of the PHP 8.2 branch that fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The notes say no complete mitigations exist and updating is the only safe choice. PHP 8.2 reaches end of life on 31 December 2026, after which it gets no security fixes.
TL;DR PHP 8.2.35 patches two critical unauthenticated RCE flaws with no mitigation other than updating, and PHP 8.2 reaches end of life on 31 December 2026.
CVEs named here
Techniques named here
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup