PHP: fixes for CVE-2026-109618 and CVE-2026-109619 (8.2.35, 8.3.36, 8.4.27, 8.5.12)

This is a record in the CVE List, the public register of security flaws. The title and any summary are in the source's own words.

The PHP project released fixes on 21 Oct 2026 for two flaws it rated critical. Matters to practices whose website runs on PHP (WordPress, Joomla) through their web host, and to self-managed servers.

Kind: Supplier question
Started: 21 Oct 2026, 15:00
Why we can name the supplier: The supplier said it, or a regulator or court record says it

Read it at the source

Products it names

PHP (The PHP Group)
WordPress (WordPress Foundation / open-source community)

The latest

We aim to update this thread. For the latest, check the supplier's own page directly: www.php.net.

This entry comes from our research build of public sources made on 24 Oct 2026.