OFFICIAL AI RUN CLOUD SECURITY BULLETIN · OCTOBER 2026
★ 100% FREE AUTO-PATCHING
Autonomous Protection Against CVE-2026-109618 & CVE-2026-109619 (CVSS 9.2).
On 21 October 2026, the PHP project released critical fixes for two unauthenticated remote code execution vulnerabilities (out-of-memory corruption and stale global state). All Ai Run Cloud nodes synchronize dynamically with our signed advisory feed and self-patch important server packages automatically—at $0 cost.
GET get.airuncloud.com/v1/advisories.json →
Autonomous Server Self-Patching: ENABLED
MINIMUM SAFE PHP RELEASES
Patched PHP Version Floors
PHP 8.5
Active Support
8.5.12
PHP 8.4
Active Support
8.4.27
PHP 8.3
Active Support
8.3.36
PHP 8.2
EOL 2026-12-31
8.2.35
Legacy PHP 8.1, 8.0 & 7.4 Notice:
PHP 8.1 and older no longer receive official upstream releases. Minimal source-code backports exist for 7.4, 8.0, and 8.1. Ai Run Cloud isolates legacy pools and enforces the 96 MB RCE Shield Worker Recycle preset.
PHP-FPM & RUNTIME ADVISORIES
Active PHP Runtime Vulnerabilities & Auto-Remediation Rules
$ php artisan airuncloud:security:sync-advisories
| CVE ID | Severity | Vulnerability Summary | Affected Range | Patched Release | Details |
|---|---|---|---|---|---|
| CVE-2026-109618 | CRITICAL · 9.2 | Unauthenticated Remote Code Execution via Out-of-Memory Corruption in PHP Runtime | >= 8.5.0, < 8.5.12 || >= 8.4.0, < 8.4.27 || >= 8.3.0, < 8.3.36 || >= 8.2.0, < 8.2.35 || < 8.2.0 | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | |
| CVE-2026-109619 | CRITICAL · 9.2 | Unauthenticated Remote Code Execution via Stale Global State in PHP Runtime | >= 8.5.0, < 8.5.12 || >= 8.4.0, < 8.4.27 || >= 8.3.0, < 8.3.36 || >= 8.2.0, < 8.2.35 || < 8.2.0 | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 |
Composer & Laravel Supply-Chain Feed
CVE-2021-3603
phpmailer/phpmailer
Remote Code Execution in PHPMailer
Fix: 6.5.0
CVE-2022-31090
guzzlehttp/guzzle
Cross-domain Authorization Header Leak in Guzzle
Fix: 7.4.5
CVE-2023-28115
laravel/framework
Cross-Site Scripting (XSS) via Blade Directives
Fix: 8.83.27
CVE-2022-24894
symfony/http-foundation
HTTP Response Splitting and Header Poisoning in Symfony
Fix: 5.4.20
CVE-2021-26120
phpunit/phpunit
Arbitrary Code Execution via Eval in PHPUnit
Fix: 9.5.20
CVE-2022-31159
aws/aws-sdk-php
SSRF & Credential Exfiltration in AWS SDK for PHP
Fix: 3.209.31
CVE-2022-23614
twig/twig
Template Sandbox Bypass in Twig
Fix: 3.3.8
WordPress Plugin & Core Security Feed
CVE-2022-1329
elementor
Authenticated Remote Code Execution in Elementor
Fix: 3.6.3
CVE-2020-35489
contact-form-7
Unrestricted File Upload in Contact Form 7
Fix: 5.3.2
CVE-2021-32693
woocommerce
Blind SQL Injection in WooCommerce
Fix: 5.5.1
CVE-2020-25213
wp-file-manager
Unauthenticated Arbitrary File Upload in WP File Manager
Fix: 6.9
CVE-2021-25036
all-in-one-seo-pack
SQL Injection & Privilege Escalation in All in One SEO
Fix: 4.1.5.3
CVE-2021-34644
wordfence
2FA Bypass in Wordfence Security
Fix: 7.5.3
CVE-2022-0320
essential-addons-for-elementor-lite
Local File Inclusion in Essential Addons for Elementor
Fix: 5.0.5