The advisory snapshot was checked on 22 October 2026. The PHP announcement is dated 21 October; the upstream changelog labels the same release 22 October. We retain the announcement date and record that source-date difference rather than silently harmonising it.
- PHP official security announcement
Published: 2026-10-21 · Checked: 2026-10-22
- PHP: RCE via OOM corruption
Published: 2026-10-21 · Checked: 2026-10-22
- PHP: RCE via stale global state
Published: 2026-10-21 · Checked: 2026-10-22
- PHP upstream support calendar
Published: no publication date supplied by this record · Checked: 2026-10-22
- Ubuntu package status: CVE-2026-109618
Published: 2026-10-21 · Checked: 2026-10-22
- Ubuntu package status: CVE-2026-109619
Published: 2026-10-21 · Checked: 2026-10-22
- Debian package status: CVE-2026-109618
Published: no publication date supplied by this record · Checked: 2026-10-22
- Debian package status: CVE-2026-109619
Published: no publication date supplied by this record · Checked: 2026-10-22
- UK NCSC: Critical security issue affecting PHP
Published: 2026-10-21 · Checked: 2026-10-22
- Cloudflare: observed attack traffic and WAF protections
Published: 2026-10-21 · Checked: 2026-10-22
Additional checks and retrieval limits
NVD record URLs for CVE-2026-109618 and CVE-2026-109619 were attempted but returned no readable record content in this review. No NVD analysis status or independent NVD score is claimed.
A CISA alert, Critical Vulnerabilities in PHP Require Immediate Patching, was located in search. Its full page was not readable through the review tool; we do not rely on it for package thresholds or claim KEV inclusion.
How corrections and future updates work
Collect an official advisory, verify identifiers and affected ranges, record vendor exceptions, prepare the content, run boundary and privacy tests, obtain human publication approval, then release and monitor. Source collection never automatically publishes an alert.
Data is a dated local snapshot, not a live feed. Positive patch results become unverified after the review-due date until the dataset is reviewed. A confirmed old vulnerable upstream release remains flagged. Send corrections privately by emailing Bytova; do not send exploit payloads or customer evidence.