PHP Announces Critical Security Release for Two Vulnerabilities

On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2.

The release is scheduled for October 21, 2026, at 14:00 UTC. PHP has indicated that the updates may be released earlier if vulnerability details become public or evidence of active exploitation emerges.

Public reports have linked CVE-2026-109618 and CVE-2026-109619 to the upcoming PHP security release. However, PHP has not yet confirmed these identifiers or disclosed technical details about the vulnerabilities.

What to Expect

PHP has not yet disclosed the technical details, affected versions, or fixed versions. This information will be published alongside the security release. Users are advised to prepare to upgrade as soon as the updates become available.

What Qualys Customers Can Do

Qualys customers can use QID 45110 – PHP Server Detected, an Information Gathered (IG) QID, to identify systems running PHP and assess their inventory ahead of the security release.

QID 45110 is a discovery check and does not confirm vulnerability to these issues. Customers should review the affected versions once PHP publishes the advisory and prioritize updates accordingly.

Note: We will update this blog as additional information becomes available, including affected versions, remediation guidance, and dedicated QIDs for detecting these vulnerabilities once the security updates are released and detection coverage is available.

Reference

PHP Security Team – Upcoming Critical PHP Security Release