Canonical event

PHP publishes security updates for CVE-2026-109618 and CVE-2026-109619

On 21 October 2026 PHP released supported branch updates fixing two critical remote-code-execution vulnerabilities. PHP's release is observed; the role and efficiency of AI-assisted discovery are source-attributed to the researchers, while patch deployment and incident impact are unknown.