php: arbitrary code execution

{
  "id": "542cd32c7a0f323ecce38b83f9b49912b461f5b7b236312ad7010a57d48578d0",
  "url": "https://security.archlinux.org/ASA-202610-1",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "php: arbitrary code execution",
    "summary": "Arch Linux reports that php versions before 8.5.12-1 are vulnerable to remote arbitrary code execution. Upgrade to 8.5.12-1; the problems were fixed upstream in 8.5.12.",
    "evidence": "The package php before version 8.5.12-1 is vulnerable to arbitrary code execution.",
    "products": [
      {
        "name": {
          "value": "php",
          "evidence": "Package : php"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "8.5.12-1",
            "evidence": "Upgrade to 8.5.12-1."
          }
        ],
        "affected_versions": [
          {
            "value": "before version 8.5.12-1",
            "evidence": "The package php before version 8.5.12-1 is vulnerable to arbitrary code execution."
          }
        ]
      }
    ],
    "severity": "critical",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-109618",
        "evidence": "CVE-ID : CVE-2026-109618 CVE-2026-109619"
      },
      {
        "value": "CVE-2026-109619",
        "evidence": "CVE-ID : CVE-2026-109618 CVE-2026-109619"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "Severity: Critical"
  },
  "source_id": "official-arch-linux-security",
  "document_id": 23281,
  "published_at": "2026-10-21T16:20:39.346+00:00"
}