Critical PHP vulnerabilities: POC released, attacks starting

A pair of critical vulnerabilities in the PHP scripting language are under active attack. The CVSS 9.4 vulnerabilities are believed to have been allocated CVE-2026-109618 and CVE-2026-109619 although the PHP foundation has yet to confirm identifiers. PHP is pushing a patch and more details live at 14:00.It gave advance warning publicly on Tuesday (October 20) saying “PHP users are encouraged to prepare to update.”. The vulnerabilities are believed to be remotely exploitable and in the core engine of all PHP versions.

Published 21-Oct-2026 11:02 UTC · First seen 21-Oct-2026 11:00 UTC

Sources

• The Stack · 21-Oct-2026