PHP Critical RCE Fix: Update to 8.5.12, 8.4.27, 8.3.36

On 21 October 2026, the PHP project released critical security updates for all supported branches, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These updates address two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involving out-of-memory handling and stale internal state. Both flaws are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution. Backend engineers are urged to identify production versions and apply these patches immediately across servers, containers, and CI/CD environments to ensure system security.