PHP just found two bugs that have been chilling in the interpreter since ~2004. Older than Laravel. Older than GitHub. Some of you were in primary school when these were committed š
php2shell (CVE-2026-109618 + 109619), CVSS 9.2, unauthenticated RCE. On mod_php it fires before your app code even runs, so your validation, middleware and that beautiful FormRequest never get a say.
The deep part: we audit our code obsessively and trust the runtime blindly. The runtime is code too.
Bump to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. On 8.1 or older? Thereās no patch coming for you. Thatās your sign to finally upgrade š«”
commit 79ffbe6