PHP’s October 21 security release fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the PHP project says could allow unauthenticated remote code execution. The fixed upstream versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP team says there are no complete mitigations; updating is the safe response. See the official PHP advisory .

CERT-In’s advisory for Indian MSMEs calls out a practical complication: PHP may be installed directly, bundled with a CMS or hosting account, or managed by a vendor. If you do not know which runtime serves a public site, check the host and application inventory rather than assuming the package manager’s PHP is the one in production.

A useful response sequence is:

Identify every PHP runtime, including containers and managed hosting.

Compare each version with the upstream or vendor’s fixed package.

Upgrade to a fixed release and restart the service that actually runs the site.

Verify the runtime version after deployment.

Review web…