Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 - release 21 October 2026, 16:00 UTC+2

Incident Report for Libyan Spider

Investigating

The PHP Security Team has announced an upcoming security release scheduled for Wednesday, 21 October 2026 at 16:00 UTC+2.
It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical).
Technical details and affected versions are scheduled to be disclosed at that time.

We will post updates here as more information becomes available.

Official announcement:
https://www.php.net/archive/2026.php#2026-10-20-1

Posted Oct 21, 2026 - 11:45 CEST