PHP’s security team has scheduled a release for 21 October 2026 at 14:00 UTC to address two critical vulnerabilities, both rated CVSS v4.0 9.2, according to the PHP project’s advance notice. The notice says full details, affected versions and fixed versions will be published with the release.
The vulnerabilities are tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619. CERT-EU says no technical details are currently available and describes the scores as indicating potential for unauthenticated remote code execution; it lists PHP versions from PHP 5 onward as potentially affected in its Security Advisory 2026-018.
There is no confirmed exploitation reported in the two fetched documents. PHP’s notice says it may release earlier if vulnerability details become public or evidence of active exploitation appears in the wild.
CERT-EU recommends that organizations identify PHP-based applications and prepare to patch as soon as fixed versions are available. Where immediate remediation is not feasible, it says organizations should consider isolating internet-facing applications from public networks until a fix can be applied.
The scope remains unresolved until PHP publishes the release details, including the precise affected and fixed versions. Administrators should therefore treat the current information as advance warning rather than a completed patch release.