PHP Security Team Accelerates Release to Patch Leaked RCE Zero-Days
The PHP security team announced an emergency release for October 21 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, after details of the embargoed flaws leaked online. Rated 9.2 under CVSS v4.0, these remote code execution bugs affect PHP core. The release was moved up from the originally planned Thursday to Wednesday to mitigate risks from the premature disclosure.