PHP security advisory (AV26-1070) - Update 1

Serial Number: AV26-1070
Date: October 21, 2026
Updated: October 27, 2026

As of October 21, 2026, PHP is affected by vulnerabilities in the following product:

• PHP
  • 8.5.x versions prior to 8.5.12
  • 8.4.x versions prior to 8.4.27
  • 8.3.x versions prior to 8.3.36
  • 8.2.x versions prior to 8.2.35

Update 1

On October 26, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-109618 and CVE-2026-109619 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• PHP Security advisory: Critical remote code execution vulnerabilities, update now
• Upcoming Critical PHP Security Release
• PHP Security Releases
• CISA KEV: CVE-2026-109618
• CISA KEV: CVE-2026-109619