Critical PHP Security Release Scheduled for October 21 to Address Remote Code Execution Vulnerabilities

The PHP security team has announced an urgent, out-of-cycle security release for October 21, 2026, at 14:00 UTC, to fix two critical remote code execution (RCE) vulnerabilities. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the CVSS v4.0 scale. Patches will be available for supported PHP branches (8.2 through 8.5), and administrators are advised to prepare for immediate updates.