PHP schedules patches for two vulnerabilities

PHP’s security team scheduled patches for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, for October 21, 2026, at 1400 UTC. Each flaw carries a severity rating of 9.2 out of 10 under the CVSS v4.0 scale. The team said it would publish technical details, affected versions and fixed releases with the updates. The planned release comes as cybersecurity authorities urge organisations to prepare to patch PHP systems promptly. The European Union’s cybersecurity response team, CERT-EU, advised organisations to consider isolating internet-facing applications from public networks if they cannot apply the fixes. CERT-EU said PHP versions from PHP 5 onward could be affected, but PHP has not confirmed the range. The Australian Cyber Security Centre also urged organisations to identify PHP systems, prepare to install updates and monitor for malicious activity. The agency said it was not aware of active exploitation at the time of its statement. Cloudflare Chief Technology Officer Dane Knecht said the company was seeing early attacks and updating firewall protections as a temporary measure. That report has not established whether the activity involved either of the two...