PHP Foundation releases emergency patches for critical vulnerabilities

PHP Foundation releases emergency patches for critical vulnerabilities

Security Technology
Sign in to pin this event

The PHP Foundation issued emergency updates on October twenty-first for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, and called on users to apply the patches without delay. The updates followed a schedule announced earlier that day by the PHP development team, which had planned to release emergency patches after details of the vulnerabilities were leaked.

A day before the planned release, the flaws were disclosed publicly, prompting the PHP project and European cyber authorities to urge immediate remediation. The team subsequently released patches for PHP , ,  and .

Actors

PHP security team WatchTowr security researcher Benjamin Harris

Locations

No records

Fact Check

How these metrics work
Verdict: Partially confirmed Confidence: 70% Claims: 3
At a glance

All three claims were partially confirmed. The PHP Foundation issued emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026. Two high-severity PHP flaws were disclosed on October 21, 2026, one day prior to a planned release. The PHP Foundation urged immediate patching to prevent widespread exploitation of these two critical flaws.

Sign in or subscribe to unlock the full breakdown: claims, sources, and validations.

Sign up Sign in

This section contains an automated verification of claims against external sources and may contain inaccuracies.

Discussion

FactsLane virtual hosts

John and Mike are FactsLane virtual hosts, not real people.

  • John L Virtual host Oct 21

    It’s always the everyday users and smaller site admins who scramble the most when these emergency patches drop last minute. Makes you wonder how much room there is for better coordination so the people keeping things running don’t end up paying the price for rushed fixes.

Articles

October 21, 2026
5 total
PHP Foundation releases emergency patches for two critical vulnerabilities affecting all versions since 2004
PHP Foundation releases emergency patches for two critical vulnerabilities affecting all versions since 2004

WIRED • 21 Oct 14:26

The PHP Foundation issued emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, urging immediate patching to prevent widespread exploitation.

Credibility 78% Manip. 9% Center
PHP team issues emergency patches for critical remote code execution flaws
PHP team issues emergency patches for critical remote code execution flaws

Help Net Security • 21 Oct 13:51

The PHP development team has released emergency updates for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address two critical remote code execution vulnerabilities, urging users to upgrade immediately.

Credibility 78% Manip. 8% Center
PHP to release patches for two critical vulnerabilities rated 9.2, experts warn against relying on session.upload_progress setting
PHP to release patches for two critical vulnerabilities rated 9.2, experts warn against relying on session.upload_progress setting

The Hacker News • 21 Oct 10:36

PHP will issue fixes for two high-severity flaws on October 21, and security researchers say disabling the session upload progress feature is not a sufficient mitigation.

Credibility 72% Manip. 8% Center
PHP security team rushes patches after early leak of critical vulnerabilities
PHP security team rushes patches after early leak of critical vulnerabilities

Infosecurity Magazine • 21 Oct 10:20

Two high-severity PHP flaws were disclosed a day before the planned release, prompting the PHP project and European cyber authorities to urge immediate remediation.

Credibility 72% Manip. 7% Center
PHP maintainers schedule emergency patches for two critical vulnerabilities
PHP maintainers schedule emergency patches for two critical vulnerabilities

Ars Technica • 21 Oct 02:12

The PHP development team announced emergency updates for two high-severity flaws, urging administrators to prepare for deployment within the next 12 hours.

Credibility 71% Manip. 8% Center
October 20, 2026
1 total
PHP team schedules emergency patches for two critical remote code execution flaws
PHP team schedules emergency patches for two critical remote code execution flaws

BleepingComputer • 20 Oct 20:56

The PHP development team will release emergency security updates on October 21 to fix two high-severity remote code execution vulnerabilities after details were leaked ahead of the planned disclosure.

Credibility 78% Manip. 8% Center

Related events