PHP security advisory (AV26-1070) - Update 1

Serial Number: AV26-1070Date: October 21, 2026Updated: October 27, 2026 As of October 21, 2026, PHP is affected by vulnerabilities in the following product: PHP 8.5.x versions prior to 8.5.12 8.4.x versions prior to 8.4.27 8.3.x versions prior to 8.3.36 8.2.x versions prior to 8.2.35 Update 1 On October 26, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-109618 and CVE-2026-109619 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. PHP Security advisory: Critical remote code execution vulnerabilities, update now Upcoming Critical PHP Security Release PHP Security Releases CISA KEV: CVE-2026-109618 CISA KEV: CVE-2026-109619