PHP Pulls Critical Fix Release Forward After Vulnerability IDs Surface

PHP moved emergency fixes up by a day after vulnerability identifiers began circulating, accelerating the response to two critical PHP flaws that put web servers at risk.

The release was scheduled for 10 a.m. ET Oct. 22 (14:00 UTC), but the fixes went out at 10 a.m. ET Oct. 21 (14:00 UTC). Identifiers for CVE-2026-109618 and CVE-2026-109619 began circulating around 11 a.m. ET Oct. 20 (15:00 UTC), without technical details.

A demonstration video showing proof-of-concept attacks appeared around 4 p.m. ET Oct. 20 (20:00 UTC). Fixed container images surfaced at 3:41 a.m. ET Oct. 21 (07:41 UTC), more than six hours before the coordinated release.

The first indication of the memory exhaustion problem came in 2024. Work on a fix later stalled amid compatibility and performance trade-offs, as well as a shortage of developers with deep PHP engine expertise. The PHP Foundation called the delay “a structural failure.”