PHP emergency patches fix two critical unauthenticated RCE flaws
Both CVSS 9.2 bugs affect web-facing PHP, including PHP-FPM and mod_php; fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Stories per day · 30 days
2 RSS
6 stories, newest first · one card per story
Stories tagged #emergency-patch
PHP schedules emergency fixes for two critical RCE flaws
watchTowr reproduced CVE-2026-109618 privately, while PHP has not confirmed scope or published a workaround.
PHP warns of two critical flaws, patches due October 21
Each flaw is rated CVSS v4.0 9.2; PHP has not confirmed CVE IDs, versions, or remote code execution.
4
PHP to release two emergency 9.2-severity patches
watchTowr says CVE-2026-109618 and CVE-2026-109619 are real; maintainers have not confirmed active exploitation.
Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950), (Mon, Sep 28th)
Apple patched exploited CVE-2026-86950 in iOS 26, macOS 26, and macOS 15 after targeted attacks.
PaperCut Zero-Day Under Active Attack: Emergency Patch Released
PaperCut warns that a zero-day in NG and MF print management products is being actively exploited, shipping emergency patches with no CVE assigned yet.
3