Checked fact 281626 Oct 2026Safety and security

The PHP project's advisory of 21 October 2026 says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

21 Oct 2026 Security advisory: "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution."

What the source said when we opened it, on 26 Oct 2026.

The source

Security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026)
PHP Group · 2026-10-21

Open the source archived copy

Checked

Checked by the notis newsroom on 26 Oct 2026, against the source above.

In the story

Stamos says attackers exploited PHP flaws before the fix; PHP urges updating now 26 Oct 2026

Cite this fact

Short permanent address

In a sentence

“The PHP project's advisory of 21 October 2026 says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.” ai notis, checked 26 Oct 2026. Source: Security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026) (PHP Group). https://ainotis.com/c/2816

As a reference (APA style)

ai notis. (2026, October 26). The PHP project's advisory of 21 October 2026 says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution [Checked claim 2816]. ai notis. https://ainotis.com/c/2816

Anyone may quote this address. It does not change; if we correct the story, this page says so.