CriticalBreachCVE-2026-109618
PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches
Cyber Security News·Source published ·1 min read
What happened?
The PHP security team has warned users about two critical vulnerabilities and urged administrators to prepare for an upcoming security release. Both flaws carry a CVSS v4.0 score of 9.2. Updates are scheduled for Wednesday, October 21, 2026, at 14:00 UTC, giving website owners and hosting providers a short window to prepare. In its official security notice, published on October 20, PHP said it would publish full technical details, affected versions, and fixed releases alongside the patches.
Key details
- Security updates scheduled for October 21, 2026 at 14:00 UTC with possible earlier release if vulnerabilities become public.
- Public reports link vulnerabilities to CVE-2026-109618 and CVE-2026-109619 as remote code execution flaws.
- CERT-EU recommends identifying PHP applications and preparing to patch immediately when fixes are available.
- No known exploitation in the wild reported by watchTowr at time of PHP's published update.
- Previous PHP vulnerability CVE-2024-4577 saw active exploitation within 24 hours of disclosure, providing context for urgent patch planning.
Affected
- PHP versions potentially from PHP 5 onward (unconfirmed by vendor).
Fixes and mitigations
- Organizations should consider isolating internet-facing PHP applications from public networks if immediate patching is not possible.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.