Arch Linux: Recent news updates
Update to php ≥ 8.5.12 and/or php-legacy ≥ 8.3.36 to prevent remote code execution
PHP versions prior to 8.5.12 and 8.3.36 are affected by CVE-2026-109618 and CVE-2026-109619, which allow for remote code execution.
For any system publicly exposing a PHP application with the help of a prior version of PHP, we urge users to upgrade those systems to the latest available version of PHP (php ≥ 8.5.12 and php-legacy ≥ 8.3.36) immediately.
source
(author: David Runge)
Update to php ≥ 8.5.12 and/or php-legacy ≥ 8.3.36 to prevent remote code execution
PHP versions prior to 8.5.12 and 8.3.36 are affected by CVE-2026-109618 and CVE-2026-109619, which allow for remote code execution.
For any system publicly exposing a PHP application with the help of a prior version of PHP, we urge users to upgrade those systems to the latest available version of PHP (php ≥ 8.5.12 and php-legacy ≥ 8.3.36) immediately.
source
(author: David Runge)
