Covered by 2 outlets — first reported by Canadian Centre for Cyber Security, Oct 27, 17:20 UTC
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2
In brief
Number: AL26-026 Date: October 21, 2026 Updated: October 27, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients.
From Canadian Centre for Cyber Security's coverage.
Continue reading
2 outlets, in the order they reported it.
Canadian Centre for Cyber SecurityFirst report
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2
Number: AL26-026 Date: October 21, 2026 Updated: October 27, 2026 Audience This Alert is intended for IT professionals and managers.
Palo Alto Unit 42
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
Explained
The technology and terms in this story. Learn more
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.