CordOriginal post
Rank 2: Process
Two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026. These vulnerabilities allow an attacker to execute arbitrary code on servers running PHP, potentially resulting in full compromise of the affected system.
Globally, there is a call to update any system using PHP to one of the patched ones:
• 8.5.12
• 8.4.27
• 8.3.36
• 8.2.35
Appwrite is powered by PHP 8.5.10 (at least, that's the version reported when running php --version in the Appwrite container).
How do these reported vulnerabilities affect Appwrite deployments, and what is the plan to upgrade to a patched PHP version?
Summary
User reported critical vulnerabilities in PHP, and the issue has been resolved successfully.
