Hi there,

PHP has released security fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 under CVSS v4.0.

If you're running PHP, please update to version 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible. You can find more details in the official PHP security announcement.

We've also added managed WAF rules to Bunny Shield to help block specific exploit patterns while updates are being rolled out. Bunny Shield provides an additional layer of protection, but keeping PHP updated remains essential.

If your website or application doesn't use PHP, no action is needed, and you can disregard this email.

Read our security update and recommended next steps.