Claim: two unpatched PHP CVEs leaked before patch release

A Mastodon post by Kevin Beaumont says CVE-2026-109618 and CVE-2026-109619 in PHP were leaked before a patch is out. Only this single post is in the data, so the claim is unconfirmed.

Timeline

1. 20 Oct, 16:39 UTCUnconfirmed claim of leaked PHP CVEs

Top sources

• Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.Kevin Beaumont