Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities

Update, 10/21/2026, 9:55 a.m.: The patches have been released, with fixes shipped as versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering the supported branches, 8.2 through 8.5. The PHP project is preparing an unscheduled security release for Wednesday to fix two vulnerabilities it rates as critical after details of the flaws leaked online and a major internet infrastructure company reported early attacks. EDT Wednesday, addresses two flaws catalogued as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10.

Published 21-Oct-2026 15:52 UTC · First seen 21-Oct-2026 15:52 UTC

Sources

• CyberScoop · 21-Oct-2026