Critical PHP RCE Vulnerability: CVE-2026-109618 and CVE-2026-109619
Critical PHP RCE Vulnerability Announced - BlueOnyx preparing Patches (updated)
The PHP development team has announced an upcoming critical security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC. The release addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
The assigned CVE identifiers are CVE-2026-109618 and CVE-2026-109619. Full technical details will be published with the release.
This was initially disclosed by security researcher Florian Roth (@cyb3rops) via X (Twitter). The official announcement was subsequently published by the PHP security team at php.net.
Important: The PHP team has stated they reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
As soon as the official patches are published by the PHP development team, the BlueOnyx maintainers will immediately begin building updated PHP packages for all supported BlueOnyx and Aventurin{e} platforms. These updates will be made available through our regular software update channels as a matter of priority.
In the meantime, we strongly advise administrators to:
- Monitor official channels for the upcoming PHP security advisory.
- Review which PHP versions are currently in use on your BlueOnyx or Aventurin{e} systems.
- Prepare to upgrade to the latest patched PHP release once the updated packages become available.
References:
- Official PHP Security Release Announcement (php.net)
- CVE-2026-109618 (MITRE – details pending release)
- CVE-2026-109619 (MITRE – details pending release)
- Initial disclosure by Florian Roth on X (Twitter)
- Florian Roth (@cyb3rops) on X
- Official PHP Website
If you have questions regarding the upcoming update or need assistance with migration planning, please contact us via the BlueOnyx support channels or post in our community forums.