PHP releases emergency update to fix two critical web server vulnerabilities

Community Trust Score Verified 81 % Real Verified 42 votes Updated 53 seconds ago On Oct. 21, the PHP team issued a series of emergency fixes designed to address two critical vulnerabilities that could potentially allow unauthenticated attackers to execute arbitrary code on web servers. The official security advisory identifies these specific flaws as CVE-2026-109618 and CVE-2026-109619. Both of these vulnerabilities carry a critical severity score when measured under the CVSS v4.0 framework. The rollout of these critical fixes followed a preliminary advance warning that was issued by the PHP team on Oct. 20.