PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026, fix two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2, and php.net says updating is
Apache with mod_php carries the highest proven risk, while PHP-FPM is susceptible by source analysis, and PHP 8.1 and older receive no official release.
In our lab session.upload_progress.enabled defaulted to 1 on PHP 8.3.21, 8.4.7 and 8.5.2, and fatal_error_backtraces defaulted to on in 8.5.2, so default installs include both settings the advisory