Back News.Lavx.Hu

PHP security team sets critical patch for Oct. 21

News.Lavx.Hu • October 20, 2026

The PHP security team will publish fixes for two critical vulnerabilities on Wednesday, Oct. 21, 2026, at 2 p.m. UTC. Both flaws score 9.2 on CVSS v4.0, and users should upgrade the moment the files go live.

The PHP security team will publish a security release on Wednesday, Oct. 21, 2026, at 2 p.m. UTC. The team patched two critical vulnerabilities for this release. Both score 9.2 under CVSS v4.0.

Prepare to upgrade the moment the files appear. The team may ship the update ahead of schedule if attackers begin exploiting the flaws or if vulnerability details leak before the scheduled window.

The release notes will list affected versions and fixed releases. Check PHP.net for download links and upgrade guides.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Disclosed On October 20, 2026, details of two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, leaked ahead of their scheduled disclosure. The PHP security team confirmed the vulnerabilities, both rated 9.2 under CVSS v4.0, and announced an emergency patch release for October 21, 2026, at 14:00 UTC. These vulnerabilities potentially affect PHP versions 5 through 8, allowing attackers to execute arbitrary code on affected servers. Security firm watchTowr verified the existence of the vulnerabilities and warned of possible following the release of the patch. Administrators are urged to prepare for immediate updates as the vulnerabilities pose significant risks to web applications powered by PHP. No active exploitation has been reported as of now, but the situation remains urgent. 17 sources 71

Extracted Entities

Domains (1)

php.net