PHP · Security
Two critical PHP vulnerability disclosures expected on 22 October
A Hacker News post reports an expected PHP announcement on 22 October 2026 at 18:00 CEST covering two remote-code-execution vulnerabilities with CVSS 10.0 ratings.
It names CVE-2026-109618 and CVE-2026-109619. The author provides no corroborating evidence. Thread comments attribute the issue to PHP core and say fixes may be limited to PHP 8.
The warning names CVE-2026-109618 and CVE-2026-109619 as the reserved identifiers for two PHP vulnerabilities. An announcement is reportedly scheduled for 22 October 2026 at 18:00 CEST. Both flaws are described as remote-code-execution issues with a CVSS score of 10.0.
The original poster says the information comes from a reliable source but offers no supporting evidence beyond that claim. The post says the affected version range could extend back to PHP 5. A later comment places the vulnerabilities in PHP core and says only PHP 8 will receive patches. Those technical details come from the discussion rather than the original warning.
Another commenter initially confused these identifiers with CVE-2026-9618 and CVE-2026-9619. Those entries concern WordPress plugins and are not RCE vulnerabilities. A separate comment links to a PHP archive statement dated 20 October 2026 and to a CERT-EU advisory. It says organisations unable to patch immediately should consider isolating internet-facing applications from public networks until a fix is available. Further details were reportedly due at 14:00 UTC the following day, although the timing could change.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.