Only for references on this:
On 10/21/26 4:41 PM, Jakub Zelenka wrote:
Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4
before 8.4.27, and PHP 8.5 before 8.5.12.
The [1] blog post claims the following affected version range for
CVE-2026-109618:
> The specific HashTable ordering behind CVE-2026-109618 was introduced
> by a performance optimization in October 2017 and first shipped in PHP
> 7.3.0 (December 2018).
[1]
https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/
Regards
