Our takePHP ships an out-of-cycle release at 14:00 UTC today for two critical RCEs (CVE-2026-109618, CVE-2026-109619). The suggested disable_functions workaround is insufficient on its own. Patch the four supported branches immediately once available.Security Resilience desk
Sources (8)
- sophos_xops · sophos_xops
- hackernews · hackernews
- hackernews · hackernews
- hackernews · hackernews
- the420_in · the420_in
- nyt_tech · nyt_tech
- sygnia · sygnia
- the420_in · the420_in
What this means for you — Security leader:Apply the out-of-cycle PHP 8.2–8.5 update as soon as it drops at 14:00 UTC today; the two RCEs cannot be fully blocked by the suggested disable_functions workaround alone.
What this means for you — Lean IT orgs:Update your PHP version (8.2–8.5) the moment the emergency release is available today — until then turn off public web access to any PHP sites if you can.
What this means for you — MSP:Push the PHP 8.2–8.5 out-of-cycle update to all client instances at 14:00 UTC today; confirm the single suggested workaround is in place but treat it as insufficient on its own.
What this means for you — Researcher:watchTowr’s PoC for CVE-2026-109618 and CVE-2026-109619 will be public; test the emergency PHP release in staging before production rollout.