PHP project announces upcoming critical security release for CVE-2026-109618 and CVE-2026-109619
The PHP project published an announcement on its php.announce mailing list about an upcoming critical security release. The announcement references CVE-2026-109618 and CVE-2026-109619.
Why it matters
PHP runs many online stores, content sites, and web applications. A critical security release means sites on affected PHP versions may need patching soon after the release is published.
Who should care
PHP developers, sysadmins, hosting providers, and ecommerce or CMS operators running PHP.
What you can do
Inventory which PHP versions your servers run and subscribe to the php.announce list so you can apply the security release as soon as it ships.