PHP

Global – October 27, 2026 -- PHP will ship an emergency patch for two critical core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Wednesday, October 21, 2026, at 14:00 UTC (10:00 ET). The PHP security team rates both flaws CVSS v4.0 9.2, and researchers describe them as unauthenticated remote code execution.

PHP reserves the right to release before 14:00 UTC

The project may ship earlier if technical details go public or exploitation appears in the wild, according to BleepingComputer. The official advisory names no vulnerable function, no affected versions and no fixed releases.

The CVE IDs, the "PHP 5 through 8" scope and the CVSS 10 figures come from researchers and a leak, not from PHP. Until the release, everything outside the official advisory remains theory.