PHP security advisory (AV26-1070) - Update 1
Serial Number: AV26-1070 Date: October 21, 2026 Updated: October 27, 2026 As of October 21, 2026, PHP is affected by vulnerabilities in the following product: PHP 8.5.x versions prior to 8.5.12 8.4.x versions prior to 8.4.27 8.3.x versions prior to 8.3.36 8.2.x versions prior to 8.2.35 Update 1 On October 26, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-109618 and…
Summary from Canadian Centre for Cyber Security.
Explained
The technology and terms in this story. Learn more
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
