Arch Linux warns of critical PHP RCE flaws, urges immediate update

Brief written by the FOSSWire AI editor from Arch Linux How we write

October 21, 2026 1 min read

Key Takeaway

Arch Linux has issued an urgent security advisory for two CVEs in PHP that enable remote code execution on publicly exposed systems.

Summary

Arch Linux maintainer David Runge published a security advisory warning that PHP versions before 8.5.12 and php-legacy before 8.3.36 are vulnerable to CVE-2026-109618 and CVE-2026-109619, both allowing remote code execution. The advisory specifically targets any system running a publicly accessible PHP application and recommends immediate upgrade to patched versions.

Affected versions and required fixes

CVE-2026-109618 and CVE-2026-109619: both enable remote code execution in unpatched PHP installations
Affected: PHP < 8.5.12, php-legacy < 8.3.36
Patched versions: php ≥ 8.5.12, php-legacy ≥ 8.3.36
Risk scope: systems with publicly exposed PHP applications
Arch Linux packages php and php-legacy both require update

Why it matters

PHP remains one of the most widely deployed server-side languages, making this a high-impact vulnerability for web hosting infrastructure. The dual-track release (current and legacy) means both active and maintenance-mode deployments need attention.

What to do

If you run Arch Linux and host a publicly accessible PHP application, update the php package to version 8.5.12 or newer.
If you use the php-legacy package instead, update it to version 8.3.36 or newer.
Apply these updates immediately, as the affected versions are vulnerable to remote code execution.

Original reference: archlinux.org →