type: cve · created: 2026-10-21 · updated: 2026-10-21 · tags: [cve] · confidence: medium · severity: medium · affected_sectors: [global] · au_impact: false
The pair are tracked as CVE-2026-109618 and CVE-2026-109619; watchTowr told BleepingComputer they affect PHP versions 5, 6, 7 and 8, that the flaws were due for coordinated release on 22 October before technical information leaked, and that it assesses both as CVSS 10 and has reproduced CVE-2026-109618 without releasing detail until patches ship.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-109619 |
| CVSS | TODO: verify |
| Vendor / product | Not stated |
| Reported | 2026-10-21 |