iTnews
Critical flaws strike PHP as disclosure embargo is broken
PHP maintainers are urging users to prepare for patches addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 for severity. Details leaked before the embargo expired, with a researcher posting alleged full vulnerability details and two proofs of concept online. The Australian Signals Directorate and CERT-EU have both issued pre-patch alerts, telling organisations to monitor PHP applications and prepare to update immediately.
Sources
- iTnews · 21-Oct-2026