PHP Pulls Critical Fix Release Forward After Vulnerability IDs Surface
Photo: TokenPost
PHP moved emergency fixes up by a day after vulnerability identifiers began circulating, accelerating the response to two critical PHP flaws that put web servers at risk . The release was scheduled for 10 a.m. ET Oct. 22 (14:00 UTC), but the fixes went out at 10 a.m. ET Oct. 21 (14:00 UTC). Identifiers for CVE-2026-109618 and CVE-2026-109619 began circulating around 11 a.m. ET Oct. 20 (15:00 UTC), without technical details. A demonstration video showing proof-of-concept attacks appeared around 4 p.m. ET Oct. 20 (20:00 UTC). Fixed container images surfaced at 3:41 a.m. ET Oct.
Source: TokenPost
