{
  "checkedAt": "2026-10-22T09:00:00Z",
  "releasedOn": "2026-10-21",
  "cves": [
    {
      "id": "CVE-2026-109618",
      "advisory": "GHSA-w8hw-w9fx-j79w",
      "summary": "Memory corruption after out-of-memory, leading to remote code execution",
      "cvss": "9.2",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    },
    {
      "id": "CVE-2026-109619",
      "advisory": "GHSA-6wmf-4rv5-p3rp",
      "summary": "Stale global state, leading to remote code execution",
      "cvss": "9.2",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    }
  ],
  "branches": [
    {
      "branch": "8.5",
      "fixed": "8.5.12",
      "kind": "release",
      "supportEnds": "2029-12-31",
      "page": null
    },
    {
      "branch": "8.4",
      "fixed": "8.4.27",
      "kind": "release",
      "supportEnds": "2028-12-31",
      "page": null
    },
    {
      "branch": "8.3",
      "fixed": "8.3.36",
      "kind": "release",
      "supportEnds": "2027-12-31",
      "page": "/eol/php-8-3"
    },
    {
      "branch": "8.2",
      "fixed": "8.2.35",
      "kind": "release",
      "supportEnds": "2026-12-31",
      "page": "/eol/php-8-2"
    },
    {
      "branch": "8.1",
      "fixed": null,
      "kind": "backport",
      "supportEnds": "2025-12-31",
      "page": "/eol/php-8-1"
    },
    {
      "branch": "8.0",
      "fixed": null,
      "kind": "backport",
      "supportEnds": "2023-11-26",
      "page": "/eol"
    },
    {
      "branch": "7.4",
      "fixed": null,
      "kind": "backport",
      "supportEnds": "2022-11-28",
      "page": "/eol/php-7-4"
    },
    {
      "branch": "7.3 and older",
      "fixed": null,
      "kind": "none",
      "supportEnds": null,
      "page": "/eol/php-5"
    }
  ],
  "sources": [
    {
      "label": "php.net announcement, 21 Oct 2026",
      "url": "https://www.php.net/index.php#2026-10-21-5"
    },
    {
      "label": "GHSA-w8hw-w9fx-j79w (CVE-2026-109618)",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    },
    {
      "label": "GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    },
    {
      "label": "PHP 8 ChangeLog",
      "url": "https://www.php.net/ChangeLog-8.php"
    },
    {
      "label": "PHP supported versions",
      "url": "https://www.php.net/supported-versions.php"
    }
  ],
  "openQuestions": [
    "Regressions in 8.5.12, 8.4.27, 8.3.36 and 8.2.35: none reported in php-src issues by 17:30 UTC on 21 Oct, but the releases were less than a day old.",
    "Exploitation: Cloudflare, watchTowr and Patchstack report attack attempts; CISA, BSI and CERT-EU had not confirmed exploitation in the wild. No official indicators of compromise have been published.",
    "CISA Known Exploited Vulnerabilities catalog: neither CVE was listed at 17:36 UTC on 21 Oct. We recheck before each update.",
    "Extended support: HeroDevs names both CVEs for PHP 7.4, 8.0 and 8.1. Zend's fix for its LTS builds is reported second-hand only, and we found nothing from TuxCare.",
    "Red Hat: RHEL 7 data lists one CVE as affected and the other as not affected; RHEL 6 is out of scope. We are waiting for a clear statement.",
    "Alpine: the security database lists fixed php84 and php85 packages, but the x86_64 package index still served 8.4.26 at 17:30 UTC.",
    "The GitHub Advisory Database had not yet published reviewed entries for either CVE, so Dependabot and similar tools may not flag them yet."
  ]
}