TECHNOLOGY · FOCUS
PHP: source patches available for critical vulnerabilities
Ars Technica reports that source patches are available for PHP vulnerabilities deemed critical. Package distribution has begun, according to its update. Administrators are urged to prepare their upgrades, while several technical details remain unconfirmed.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
Source patches were added to the php-src repository on GitHub at 13:34 UTC, according to an update from Ars Technica. The outlet says packages and Docker images are beginning to be distributed from these sources. This development updates the initial alert, which had still described the release as imminent.
PHP maintainers had announced patches for two vulnerabilities, both rated 9.2 out of 10. Ars Technica reports the identifiers CVE-2026-109618 and CVE-2026-109619, whose existence was confirmed by security company watchTowr. However, details that circulated before the patches were released were still described as unconfirmed. They do not support a claim that all installations are exposed in the same way.
For organizations, the preparation described involves identifying those responsible for PHP, taking inventory of affected applications, scheduling maintenance and backing up website files and databases. The availability of source code alone does not establish that every environment already has a suitable package available.
The immediate priority therefore remains monitoring the availability of updates and applying them as soon as possible. The article does not document an active exploitation campaign: predictions of attacks made by security companies must remain distinct from attacks actually observed.