Upcoming critical PHP security release (CVE-2026-109618 / -109619)
- ID
- 37780
- Status
- summarized
- Published
- 21 Oct 2026, 4:15 AM
- Fetched
- 21 Oct 2026, 6:28 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://news-web.php.net/php.announce/509
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.5
- Created
- 21 Oct 2026, 6:28 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
The PHP security team posted a pre-disclosure notice for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical), with a coordinated release set for Wednesday 21 October 2026 at 14:00 UTC. The announcement, posted by Jakub Zelenka to php.announce, gives no affected versions, no vulnerability class, and no exploit details, and states the team may ship earlier if details leak or active exploitation is detected. The Hacker News thread drew 811 points and 322 comments, largely speculation in the absence of technical detail.
Why it matters
14:00 UTC is 10:00 PM Malaysian time, so the patch lands overnight for local teams — decide now who is on call to apply it, and whether you can even control the PHP version. If you run Laravel, WordPress, or Drupal on shared or managed hosting, the upgrade is gated on your host's PHP build, not your composer.json, so message them today rather than discovering it tomorrow. Note that nothing about severity is knowable beyond the 9.2 rating: there are no affected version ranges yet, so don't guess at exposure or rewrite code before the advisory lands.
Discussion angle
Walk through an actual patch-response plan for a 10 PM MYT drop: who checks the advisory at 14:00 UTC, how you inventory PHP versions across shared hosting you don't control, and whether it's worth pre-staging a rollback before you know what the vulnerability even is.