PHP security team

Search everything

Mentions · 7d5
Mentions · 30d5
All mentions5
First seenOct 20, 2026
Last mentioned4d ago

Timeline

5 articles · newest first

PHP 8.2–8.5 RCE via stale global state (CVE-2026-109619)

PHP rates the core flaw critical at CVSS v4.0 9.2; fixed builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

oss-securityupdated Oct 21, 23:02 UTC · 3d agofirst Oct 21, 15:10 UTC · 4d agoVulnerability 30 sourcesCVE-2026-109619

PHP 8.2–8.5 RCE via out-of-memory corruption (CVE-2026-109618)

An allocation failure during request setup can leave incomplete state reachable, rated CVSS v4.0 9.2.

oss-securityupdated Oct 21, 23:02 UTC · 3d agofirst Oct 21, 15:08 UTC · 4d agoVulnerability 30 sourcesCVE-2026-1096181 · 1 read

Dutch NCSC takes its website offline over PHP flaws

A PHP security patch is planned for 16:00 Dutch time, and NCSC expects an advisory within an hour.

Hacker News · securityOct 21, 12:31 UTC · 4d agoAdvisory HN 59 points · 15 comments1 · 1 read

PHP security team schedules critical release for October 21

Two flaws each scored 9.2 will be detailed with patched versions at 14:00 UTC, or sooner if they leak.

Help Net Securityupdated Oct 21, 13:40 UTC · 4d agofirst Oct 21, 04:21 UTC · 4d agoVulnerability 30 sources2 · 1 read

PHP to fix two CVSS 9.2 flaws on October 21

The PHP security team may publish earlier if details leak or exploitation appears.

Hacker News · securityupdated Oct 21, 13:40 UTC · 4d agofirst Oct 20, 20:15 UTC · 4d agoVulnerability 30 sources HN 22 points · 1 comments

Related CVEs

by mentions

CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 4d agophpPoC ×13
CVE-2026-10961812%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 4d agophpPoC ×25

Appears with

PHPproduct · 3
PHPvendor · 2
NCSCorganization · 1

Entities are extracted by the model from each article. First seen Oct 20, 2026, last mentioned 4d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.