PHP warns admins of two critical flaws, emergency patches coming tomorrow

The PHP security team is telling administrators to get ready for emergency security updates scheduled for Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern) to fix two critical vulnerabilities, according to an advisory the development team published Tuesday. The team sent a notice to its ANNOUNCE mailing list urging administrators to install the updates as soon as they are available. PHP underpins a wide range of websites and web applications, including content management systems, e-commerce platforms, and custom web services, so the fixes reach well beyond any single vendor. The development team has rated each of the two flaws 9.2 under CVSS v4.0.

The PHP developers have not released technical details about either vulnerability. They have not said which PHP versions are affected, how the flaws can be exploited, or which releases will carry the fixes. They have also reserved the right to ship the updates earlier if details of either vulnerability become public or if evidence of active exploitation shows up. Full technical details, affected versions, and fixed releases are to be published once the updates are out.

Security researchers at watchTowr told BleepingComputer that the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and are remote code execution flaws believed to affect PHP versions 5, 6, 7, and 8. WatchTowr CEO Benjamin Harris said information about the two flaws leaked in the prior hour and that they had been under embargo with a planned release on Thursday at 11 am ET. He said the firm could not share technical information at this point given the sensitivity but confirmed both vulnerabilities are real. WatchTowr said it believes it has successfully reproduced CVE-2026-109618 and will hold back technical information until security patches are available.

WatchTowr also said it has not observed exploitation of the vulnerabilities in the wild despite the reported leak. In a post on X, the researchers said information had leaked about the embargoed zero-day RCE vulnerabilities in PHP and confirmed the flaws are real. The leak discussion traces to a now-deleted post on Y Combinator's Hacker News forum, in which a user named petecooper claimed two critical PHP remote code execution vulnerabilities would be disclosed on October 22.

That Hacker News post, seen by BleepingComputer, claimed both vulnerabilities carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5. It also named the flaws as CVE-2026-109618 and CVE-2026-109619, the same identifiers watchTowr later shared.

The leak claims and watchTowr's statements differ from PHP's official announcement in two respects. Both described the vulnerabilities as CVSS 10.0, while the PHP security team assigned each a CVSS v4.0 score of 9.2. WatchTowr also cited an originally planned Thursday disclosure, while PHP has officially scheduled its security release for Wednesday morning.

More cybersecurity news from TechManNews.