Two Critical PHP Flaws Leaked Ahead of the October 21 Security Release
The PHP project has scheduled a security release for two critical flaws, each rated 9.2 under CVSS v4.0, for 14:00 UTC on October 21. Information leaked the day before, and CERT-EU identifies the flaws as CVE-2026-109618 and CVE-2026-109619.