Two days between warning and patch: how the PHP project handled CVE-2026-109618
Two days between warning and patch: how the PHP project handled CVE-2026-109618 The PHP project pre-announced its October 2026 security release on 20 October and published fixes on 21 October. For two vulnerabilities rated 9.2 under CVSS v4.0, that schedule is the most useful part of the story for anyone who has to plan a response next time. What shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35…
The PHP project announced its October 2026 security release two days before publishing the fixes on 21 October. This brief window between warning and patch is crucial for planning a response. The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both grant unauthenticated remote code execution. The first flaw is a memory corruption issue in PHP's out-of-memory path, while the second is a lifetime defect where internal request state remains reachable after being released.
Both flaws require no authentication and can lead to denial of service or information disclosure. The pre-announcement provides distribution maintainers and long-term support vendors a day to stage packages, which is why refreshing packages on Linux is typically faster than waiting for a source build. For embedded systems, which lack a mechanism to ingest upstream patches on this timetable, the NCSC-NL repository is recommended as the place to check if a third-party product is affected.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
