Php Security - GoKawiil

PHP team schedules critical security release for October 21

The PHP project announced an upcoming security release fixing two critical vulnerabilities, each rated 9.2 on the CVSS v4.0 scale. The patch is planned for Wednesday, 21 October 2026 at 14:00 UTC, with the PHP security team urging users to prepare in advance.

news-web.php.net · 2026-10-20

PHP team to release emergency patches for two critical RCE flaws after leak

The PHP security team announced it will ship fixes on Wednesday, October 21 at 14:00 UTC for two vulnerabilities each rated 9.2 on CVSS v4.0, after details reportedly leaked ahead of a planned embargoed disclosure. Researchers at watchTowr say the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs affecting PHP versions 5 through 8, and that watchTowr has reproduced one of them without releasing technical details.

bleepingcomputer.com · 2026-10-20