CVE-2026-109618: Two critical PHP flaws, the language behind WordPress, leaked before a patch was ready

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

Two critical PHP flaws, the language behind WordPress, leaked before a patch was ready

The PHP team moved up its patch release after details of two flaws rated 9.2 out of 10 leaked. Here is how to prepare in the meantime, and why older versions are a concern.

Oct 21, 20262 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)