The PHP development team released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, fixing two vulnerabilities with CVSS v4.0 severity scores of 9.2: CVE-2026-109618 and CVE-2026-109619, which allow remote code execution by unauthenticated attackers.
Why it matters. About seven out of ten websites globally use PHP, and the fix for this vulnerability has been widely concerned.
How AiSeek assessed the claims behind this change, and on what evidence. It is a record of an assessment, not a certificate that a claim is true.
Claim 1
Class: FactStated directly by a source, with the passage located.
Independence0 origins confirmed distinct · 1 not shown to be independent · 1 pieces of evidence
Receipt digestsha256:0f72ff99…036d98Check integrity
Claim 2
Class: FactStated directly by a source, with the passage located.
Independence0 origins confirmed distinct · 1 not shown to be independent · 1 pieces of evidence
Receipt digestsha256:2e7f99ce…e73cfbCheck integrity
Claim 3
Class: FactStated directly by a source, with the passage located.
Independence0 origins confirmed distinct · 1 not shown to be independent · 1 pieces of evidence
Receipt digestsha256:12eac22b…eee609Check integrity
17 more claims are in the record.
How it looked when first published is older than the 7 days your plan can replay. See plans
A receipt is not a certificate of truth. It shows how AiSeek assessed a claim and that the record has not been altered since. How receipts work