PHP Architect · Vol 25, Issue 11 · November 2026
Out of Memory, Out of Bounds: October's PHP Emergency Release
On October 21, 2026, the PHP project shipped 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix two unauthenticated remote code execution flaws. Both are rated CVSS 9.2. A score of 10.0 circulated online beforehand, and it was wrong.
The full article is in PHP Architect Vol 25, Issue 11. Subscribe to read it and every new issue.
