High-Risk RCE Vulnerability Exposed in PHP Core; Official Security Update Scheduled for October 21 at 22:00 (UTC+8)
The official PHP team has announced a patch to fix two high-risk remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affecting the core interpreter. These vulnerabilities impact all PHP versions since 5.4. Official fixes are only provided for PHP 8.2, 8.3, 8.4, and 8.5. For end-of-life (EOL) versions, public network access must be restricted or network isolation implemented immediately.
A high-risk RCE vulnerability has been exposed in the PHP core, and an official security update is scheduled for release on October 21 at 22:00 (UTC+8).
The official PHP team has announced a patch to fix two high-risk remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2) affecting its core interpreter. The affected range includes all historical and modern versions since PHP 5.4, covering branches such as PHP 5.x, 7.x, and 8.0 through 8.5. The attack can be triggered before any business framework code is executed.
The official fix is only provided for supported branches (PHP 8.2, 8.3, 8.4, and 8.5). Versions that have reached End of Life (EOL) will not receive official patches. Administrators must immediately restrict public network access or implement network isolation to prevent exploitation.
Source: sansec