The PHP security team has warned users about an upcoming release that fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale.
The PHP project has announced a security release that will address two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are classed as critical, with a CVSS v4.0 score of 9.2.
According to the PHP security team, the update is planned for Wednesday, 21 October 2026, at 14:00 UTC. The team is urging everyone who runs PHP to get ready ahead of time, so that they can install the new version as soon as it becomes available.
The announcement does not describe the nature of the flaws or which PHP versions are affected. Those details are not included in the notice.
The team has also said the schedule is not fixed. It reserves the right to publish the release earlier if details of either vulnerability become public, or if there is evidence that the flaws are being actively exploited in the wild.
For administrators and developers, the practical takeaway is to plan for the update now. That could mean checking which PHP versions are in use across servers and applications, and setting aside time to apply the patch on the day of release, or sooner if the team moves the date forward.
Source: Hacker News (front page)
