Skip to main content
PHP vulnerabilities

CVE-2026-109618 and CVE-2026-109619 PHP vulnerabilities

Written by Phil Hambly on . Posted in News.

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 with PHP’s security team rates both at 9.2 out of 10 on the CVSS v4.0 severity scale were leaked 20th October 2026.

Patches were released and applied to our PHP servers during auto patching 21st October 2026 securing services to our clients.

Clients are encouraged to check their websites to ensure they’re using a patched version of PHP. CMS websites such as WordPress should also be updated.

NOTES:
– The fixes for these vulnerabilities are in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
– WordPress latest version is 7.1.3 released 6th October 2026.