Arch Linux - News: Update to php ≥ 8.5.12 and/or php-legacy ≥ 8.3.36 to prevent remote code execution

2026-10-21 - David Runge
PHP versions prior to 8.5.12 and 8.3.36 are affected by CVE-2026-109618 and CVE-2026-109619, which allow for remote code execution.
For any system publicly exposing a PHP application with the help of a prior version of PHP, we urge users to upgrade those systems to the latest available version of PHP (php ≥ 8.5.12 and php-legacy ≥ 8.3.36) immediately.
Edit: For further details and instructions, please refer to the Arch Linux Security Advisories ASA-202610-1 and ASA-202610-2.
Copyright © 2002-2026 Judd Vinet, Aaron Griffin and Levente Polyák.
The Arch Linux name and logo are recognized trademarks. Some rights reserved.
The registered trademark Linux® is used pursuant to a sublicense from LMI, the exclusive licensee of Linus Torvalds, owner of the mark on a world-wide basis.