Simon Melotte

🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0. ⠀ Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8. PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases. ⠀ The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected. ⠀ Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.