PHP: security release today at 14:00 UTC for two critical CVSS 9.2 flaws

The PHP security team published a pre-notification advisory on 20 October 2026 on php.net: a security release is scheduled for Wednesday 21 October 2026 at 14:00 UTC and addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. For those managing LAMP, LEMP or shared hosting infrastructure based on PHP, now is the time to plan the upgrade before the release time arrives.

What the official announcement actually says

The text published by php.net is deliberately sparse. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. The advisory also specifies that full details, affected versions, and the fixed versions will be published with the release. Until the release moment, therefore, PHP neither confirms CVE identifiers nor affected versions.

Two identifiers are circulating online nonetheless, CVE-2026-109618 and CVE-2026-109619, along with a CVSS score of 10.0 higher than the official one. This data comes from third-party sources: "We can confirm that they're real," the researchers said. It also identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, referring to watchTowr researchers following a post leaked on Hacker News. But watchTowr's statements and the Hacker News post are different from PHP's official announcement. Both described the vulnerabilities as CVSS 10.0, while the PHP security team assigned each a CVSS v4.0 score of 9.2. Best to stick with the official figure until the patch publication.

Who gets the patch

The announcement doesn't say, but the official supported branches page clarifies who is covered by security fixes today:

Branch	Initial release	Active support until	Security-only until
8.2	8 Dec 2022	31 Dec 2024 (expired)	31 Dec 2026
8.3	23 Nov 2023	31 Dec 2025 (expired)	31 Dec 2027
8.4	21 Nov 2024	31 Dec 2026	31 Dec 2028
8.5	20 Nov 2025	31 Dec 2027	31 Dec 2029

Those still on PHP 8.1 or earlier versions will not receive any fix from this release: those branches have been out of support for some time, as the official branches page reports.

What to do now

Check your PHP version with php -v, identify all affected servers and prepare the upgrade procedure for your control panel or package manager (apt, dnf, or your provider's repository). Technical details, official CVEs and patched versions will be published by PHP at the time of today's release at 14:00 UTC on php.net/archive/2026.php.