PHP Announces Critical Security Release for Two Vulnerabilities
Source: Qualys Blog
At a glance
On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for October 21, 2026, at 14:00 UTC . PHP has indicated that the updates may be released earlier if vulnerability details become public or evidence of active exploitation emerges. Public reports have linked CVE-2026-109618 and CVE-2026-109619 to the upcoming PHP security release. However, PHP has not yet confirmed these identifiers or disclosed technical details about the vulnerabilities. What to Expect PHP has not yet dis…