Is PHP 8.4.26 affected?

Sep 24, 2026 · Release notes ↗

CVSS 9.2

2 known vulnerabilities affect 8.4.26 (highest CVSS 9.2).

1 newer release in its track, up to 8.4.27. What changed up to 8.4.27

A newer release line is out: 8.5.12.

Vulnerabilities affecting 8.4.26

9.2
CVE-2026-109618 RCE via OOM corruption fixed in 8.4.27
9.2
CVE-2026-109619 RCE via stale global state fixed in 8.4.27

Newer releases

Oct 21, 2026

8.4.26 → 8.4.27