REPORTED DEVELOPMENT
The PHP development project published security releases addressing CVE-2026-109618 and CVE-2026-109619. The issues can, in certain affected configurations, expose applications to unauthenticated remote code execution. The announced corrected versions include PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Security researchers at Wiz documented exploitation scenarios involving widely used content-management systems. The PHP project advises affected operators to install patched releases; actual exposure depends on version, configuration and deployment conditions.
The advisory does not establish that a particular retailer or other company has been compromised, nor that any specific website uses a vulnerable runtime.
WHY IT MATTERS TO THE MARKET
Fashion and consumer businesses often depend on web applications and third-party commerce infrastructure. Software dependency inventories, patch ownership, vendor confirmation and incident-response readiness are operational obligations that extend beyond the visible e-commerce front end.