# Arch Linux warns of critical PHP RCE flaws, urges immediate update

> **Key takeaway:** Arch Linux has issued an urgent security advisory for two CVEs in PHP that enable remote code execution on publicly exposed systems.

**Published:** 2026-10-21T13:58:42+00:00 
**Source:** Arch Linux Official News 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/arch-linux-warns-of-critical-php-rce-flaws-urges-immediate-u.html 

## Summary
Arch Linux maintainer David Runge published a security advisory warning that PHP versions before 8.5.12 and php-legacy before 8.3.36 are vulnerable to CVE-2026-109618 and CVE-2026-109619, both allowing remote code execution. The advisory specifically targets any system running a publicly accessible PHP application and recommends immediate upgrade to patched versions.

## Affected versions and required fixes
- **CVE-2026-109618** and **CVE-2026-109619**: both enable remote code execution in unpatched PHP installations
- Affected: PHP < 8.5.12, php-legacy < 8.3.36
- Patched versions: php ≥ 8.5.12, php-legacy ≥ 8.3.36
- Risk scope: systems with publicly exposed PHP applications
- Arch Linux packages `php` and `php-legacy` both require update

## Why it matters
PHP remains one of the most widely deployed server-side languages, making this a high-impact vulnerability for web hosting infrastructure. The dual-track release (current and legacy) means both active and maintenance-mode deployments need attention.