# PHP Pulls Critical Fix Release Forward After Vulnerability IDs Surface By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/37822 Published: 2026-10-22T12:06:48.000Z Updated: 2026-10-22T12:06:48.000Z Section: Technology > A proof-of-concept video appeared Oct. 20, while patched container images surfaced more than six hours before the coordinated release. PHP moved emergency fixes up by a day after vulnerability identifiers began circulating, accelerating the response to [two critical PHP flaws that put web servers at risk](). The release was scheduled for 10 a.m. ET Oct. 22 (14:00 UTC), but the fixes went out at 10 a.m. ET Oct. 21 (14:00 UTC). Identifiers for CVE-2026-109618 and CVE-2026-109619 began circulating around 11 a.m. ET Oct. 20 (15:00 UTC), without technical details. A demonstration video showing proof-of-concept attacks appeared around 4 p.m. ET Oct. 20 (20:00 UTC). Fixed container images surfaced at 3:41 a.m. ET Oct. 21 (07:41 UTC), more than six hours before the coordinated release. The first indication of the memory exhaustion problem came in 2024. Work on a fix later stalled amid compatibility and performance trade-offs, as well as a shortage of developers with deep PHP engine expertise. The PHP Foundation called the delay “a structural failure.” ## Links in this article - [two critical PHP flaws that put web servers at risk](https://www.tokenpost.com/news/technology/37442)