PHP Security Release October 2026: Two Critical RCE Flaws and What to Do Now

On 21 October 2026 PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical remote code execution flaws. What they are, who is most exposed, how to patch and verify, and what to do if you cannot update today.