Miguel Ángel Durán reported that PHP had released urgent patches for the vulnerabilities CVE-2026-109618 and CVE-2026-109619, which, he explained, could allow for remote code execution without authentication. He indicated that the available versions were 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Durán pointed out that the flaws affected servers with PHP-FPM, Apache with mod_php, LiteSpeed, and php-cgi. He also stated that an attack against Apache with mod_php had been demonstrated that could be executed without authentication and before the application code was started. He added that, although PHP 8.1 and earlier versions were no longer officially supported, exceptional patches had been released for PHP 7.4, 8.0, and 8.1 due to the severity of the issue. According to Durán, some Linux providers would also distribute their own patches. He warned that temporary mitigations did not fully resolve the vulnerabilities and maintained that the complete solution was to upgrade. https://t.co/0igSmeittC #PHP #Seguridad #Actualizaciones (translated)