TR-102 Critical Vulnerabilities in PHP (Potentially Exploited) – CVE-2026-109618 and CVE-2026-109619

Introduction Two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been reported in the PHP runtime.
Both have a CVSS v4.0 base score of 9.2 (Critical). Preliminary reports indicate that the vulnerabilities could enable remote code execution (RCE), potentially without authentication, on affected web servers.
The PHP development team has announced an exceptional security release for 21 October 2026 at 14:00 UTC (16:00 Luxembourg time).
At the time of this report, the upstream project has not yet published the complete technical details, definitive affected-version ranges, or fixed-version list.CIRCL updatesRead More