The PHP Foundation issued emergency patches for CVE-2026-109618 and CVE-2026-109619, which can enable remote system control and affect web-serving PHP installations dating to version 5 from July 2004. Only PHP 8.2 and newer are officially supported; updating is the only complete safeguard.