Skip to content
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Disclosed

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Disclosed

First seen 22 Oct 2026, 03:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 03:38 UTC
  • •CVE-2026-109618 and CVE-2026-109619 both have a CVSS score of 9.2, marking them as critical.
  • •Patches for affected PHP versions were released on October 21, 2026.
  • •Exploitation can lead to unauthenticated remote code execution through memory corruption.

Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, both with a CVSS score of 9.2. CVE-2026-109618 allows unauthenticated remote code execution (RCE) via out-of-memory (OOM) corruption during request processing, while CVE-2026-109619 enables RCE through stale global state across requests. Affected versions include PHP 8.5, 8.4, 8.3, and 8.2, with patches released in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The vulnerabilities exploit memory management issues, potentially allowing attackers to execute arbitrary code. Security professionals are advised to apply the patches immediately to mitigate risks. The vulnerabilities were first reported on Hacker News on October 20, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Vulnerabilities reported on Hacker News
The vulnerabilities CVE-2026-109618 and CVE-2026-109619 were first disclosed, highlighting critical risks in PHP.
Reddit
2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Both vulnerabilities were officially published with a CVSS score of 9.2, indicating critical severity.
Sploitus
2026-10-21
Patches released for affected PHP versions
PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were patched to address the vulnerabilities.
Reddit

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

What versions of PHP are affected?
PHP versions 8.5, 8.4, 8.3, and 8.2 are affected by these vulnerabilities.
What is the severity of these vulnerabilities?
Both CVE-2026-109618 and CVE-2026-109619 have a CVSS score of 9.2, indicating critical severity.
Have patches been released?
Yes, patches for the affected PHP versions were released on October 21, 2026.