Thank you for the heads-up. For other readers: the advisory published on php.net on October 21 covers two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
New PHP runtimes
We are preparing updated PHP runtimes with these fixes, and they will be available through the Web Update utility (Check for updates in ExeOutput for PHP). We will post here when they are online.
Is an application at risk without the External HTTP Server?
The risk is much lower. Without the External HTTP Server, the application opens no network port: PHP receives requests only from the application's own window, through a local Windows named pipe. Nobody on the network or the Internet can send a request to it, and that is the scenario the advisory describes (an unauthenticated attacker sending a crafted request to a PHP web server).
What remains is the content your application itself sends to PHP. If your application only shows your own pages, there is no remote path to these vulnerabilities. If it loads remote web content that can submit requests to your PHP pages, or processes untrusted files or data, we still recommend switching to the updated runtime once it is available.
With the External HTTP Server enabled
The application then serves PHP over HTTP on the port you set, so it should be treated like any PHP web server: update the PHP runtime as soon as the fixed versions are available, and until then, block that port in the firewall for any computer that does not need access.
