# IPA warns of upcoming PHP security release

Published: 2026-10-20 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/b3a35532-2bf0-5897-bbaf-9c9cd965baf2/ipa-warns-of-upcoming-php-security-release

> IPA advises preparing for a PHP security release fixing two vulnerabilities affecting PHP 5+, not yet confirmed exploited in the wild.

The Information-technology Promotion Agency (IPA) of Japan issued a pre-alert advising organizations to prepare for an upcoming PHP Group security release addressing two vulnerabilities, scheduled for publication on October 21, 2026 at 23:00 JST. As of the advisory's publication, no patches, detailed affected version ranges, or fixed versions have been released, and IPA states it has not confirmed any in-the-wild exploitation of these flaws.

CERT-EU has referenced these issues under the identifiers CVE-2026-109618 and CVE-2026-109619, noting that PHP 5 and later are affected. IPA notes that PHP is used not only directly in web applications but is often embedded within software products and network devices, where its presence may not be visible to end users; organizations are urged to check vendor documentation and security bulletins for PHP usage in deployed products.

IPA recommends that website operators and developers inventory their use of PHP wherever feasible and prepare to apply the forthcoming patches as soon as they are released, citing past rapid exploitation patterns following PHP vulnerability disclosures (referencing a prior 2024 advisory on exploited PHP vulnerabilities). IPA specifically flags continued use of end-of-life PHP versions as a risk factor, warning that attackers may move to exploit these vulnerabilities very quickly after release details become public.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618, CVE-2026-109619

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/pre-alert20261021.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b3a35532-2bf0-5897-bbaf-9c9cd965baf2/ipa-warns-of-upcoming-php-security-release.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup