
PHP 8.5.12 RCE: what I would change after CVE-2026-109618
PHP 8.5.12 shipped 21 Oct 2026 for CVE-2026-109618 and CVE-2026-109619. php -v on Ubuntu 24.04 still prints 8.3.6 after USN-8948-1. I would read the package revision, then the FPM binary Nginx uses. This is a PHP-core RCE, not a Laravel Composer bump.
Oct 30, 2026 · 11 min read