Upcoming critical PHP security release (CVE-2026-109618 / -109619)

PHP installations face a mandatory upgrade within 24 hours to avoid critical vulnerabilities.

PHP is preparing to release a critical security update on Wednesday, October 21, 2026, at 14:00 UTC. This release will address two severe vulnerabilities, both assigned a CVSS v4.0 score of 9.2, classifying them as critical. The PHP security team is urging all users of the PHP scripting language to prepare for this update and to apply it as soon as it becomes available. They have also stated that the release might be expedited if details of either vulnerability are disclosed publicly or if there is evidence of active exploitation occurring in the wild. This proactive announcement aims to give users sufficient notice to plan for the necessary upgrade, minimizing potential security risks associated with these critical flaws.

The imminent release of patches for two critical PHP vulnerabilities (CVE-2026-109618 / -109619) signals a potential period of heightened risk for websites and applications running on PHP. With a CVSS score of 9.2, these vulnerabilities are severe and could be actively exploited, making prompt patching essential for all PHP users. The PHP Group's decision to announce this release in advance suggests a commitment to responsible disclosure and an effort to mitigate widespread impact by giving the community time to prepare for the update.

This critical security release underscores the ongoing need for vigilance in maintaining web application security, especially for widely used server-side languages like PHP. Developers and system administrators must prioritize applying these patches to protect their infrastructure from potential attacks that could compromise data or disrupt services. The possibility of an earlier release, should details become public or exploitation begin, adds urgency to the need for preparedness, highlighting the dynamic nature of cybersecurity threats.