PHP's notice names no bug type, CVE IDs or affected versions for two critical flaws (CVSS v4.0 9.2 each) due to be fixed Oct 21 at 14:00 UTC, sooner if details go public. A leak says RCE, CVE-2026-109618 and CVE-2026-109619, PHP 5 onward. watchTowr, a security testing vendor, says it confirmed the leak, but its FAQ calls the scope unverified. PHP supports only 8.2 to 8.5.
news-web.php.netphp.announce: [ANNOUNCE] Upcoming Critical PHP Security Release