PHP Patches Two Critical RCE Flaws; Web Operators Urged to Update
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. Temporary measures do not fully remove risk.
PHP’s development team released security updates on October 21, 2026 for two critical flaws that can allow unauthenticated remote code execution: CVE-2026-109618 and CVE-2026-109619. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Follow OrangeX.com Security.
Web-serving installations in scope
The official advisory covers PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It identifies mod_php as the highest-risk configuration, with a demonstrated attack before application code runs.
PHP says updating is the complete solution; temporary measures only reduce specific attack paths. Operators using distribution packages should check vendor fixes. Older branches need vendor support or migration to a supported release. More coverage is available in OrangeX.com News.
OrangeX.com Analysis
Crypto businesses running affected PHP web infrastructure have reason to review their deployments. This is a server-software advisory, not evidence that a named exchange, wallet or blockchain has been breached. A published patch also does not show that every operator has deployed it. Verification resources are available in the OrangeX.com Trust Center.
Related Reports
CISA and FBI Warn of SafePay Ransomware, Citing at Least 600 Victims Since 2024
The October 20 joint warning highlights exposed credentials, internet-facing systems and backup disruption; its victim count is not specific to crypto businesses.
Project Eleven and Relm Study Quantum Readiness in Crypto Insurance
Relm will advise on Strongpoint custody controls. The exploratory partnership does not establish premium discounts or new insurance coverage.
BiFi Security Reports Detail USDT Market Exploit and $159K Return
Security reports described a BiFi interest-calculation exploit extracting about 165,600 USDT, followed by a reported return of 159,103 USDC on October 18.
