PHP Schedules Security Update for Two Critical Vulnerabilities

Two critical PHP vulnerabilities are putting crypto businesses that use the programming language on alert as the PHP security team prepares a security update for Wednesday.

Each flaw has a 9.2 score under the Common Vulnerability Scoring System (CVSS) version 4.0, placing both in the critical range. They are tracked as CVE-2026-109618 and CVE-2026-109619 and may allow remote code execution on affected servers.

The conditions needed to exploit these flaws and the PHP versions affected have not yet been confirmed.

SlowMist urged teams to identify servers and business systems that use PHP and prepare to upgrade them. PHP is commonly used in website back ends, making the warning relevant to crypto operations that rely on those systems.

Full vulnerability details and the list of affected and fixed versions are due with the security update, scheduled for Wednesday, Oct. 21, at 10 a.m. ET (14:00 UTC).