The PHP Security Team has announced an upcoming security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical). Technical details and affected versions are scheduled to be disclosed at that time.
We will post updates here as more information becomes available.