PHP prepares emergency security updates for two serious vulnerabilities

PHP scheduled an out-of-cycle security release to address two remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619.

Official updates are designated for supported branches 8.2 through 8.5 following an advance notice triggered by an embargo leak.

How the case began

The warning came earlier than planned, due to an online leak. On October 20, a post on an online platform claimed that there were two serious security flaws affecting the language from older versions. This was followed by confirmation from security companies, who said that the leaked information was true and related to issues that were still under official secrecy.

The official PHP team reacted and announced an emergency release of fixes for Wednesday, October 21. So far, researchers are using the identifiers for the two issues, while claims that all versions from 5 onwards are affected have not been confirmed by an official announcement.

Which versions are affected?

Official fixes will only be provided for the four actively supported versions of the language, namely the 8.2 to 8.5 series. Older versions that are no longer supported will not receive any official updates.

READ ALSO

Serious security issues in PHP bring warnings for immediate updates or website shutdown

Data analytics and security firms note that hundreds of thousands of systems worldwide are still running older and unsupported versions of PHP. According to the groups, no actual attacks on systems have been reported so far, nor has any workaround been published by the language's creators before the official release.

G

Hacks.gr on Google

Set it as a preferred source for cybersecurity updates.

Preferred source

Read the original English article on Hacks.gr