PHP Accelerates Emergency Patch for Leaked Critical RCE Flaws

Key points

• PHP will release out-of-cycle security patches at 14:00 UTC on October 21 for two critical vulnerabilities rated 9.2 on CVSS v4.0.
• The flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow remote code execution but lack official technical descriptions from PHP.
• Only PHP branches 8.2 through 8.5 will receive fixes; versions 8.1 and older are end-of-life and will not be patched.
• The release was accelerated from October 22 to October 21 after a leak on October 20 revealed the vulnerabilities' existence and identifiers.
• Security firm watchTowr confirmed the flaws are real but noted that the claim they affect all PHP versions since 5.0 remains unconfirmed by official advisories.
• No active exploitation has been reported as of October 21, and the flaws are not listed in CISA's Known Exploited Vulnerabilities catalog.

Background

This incident follows a broader trend of critical infrastructure vulnerabilities in late 2026, including recent patches for NGINX and GitLab AI Gateway flaws. PHP's accelerated response mirrors previous emergency releases where leaked details forced vendors to move up disclosure timelines to mitigate potential exploitation.

How outlets are covering it

The Hacker News emphasizes the lack of technical details and the limited scope of patches to supported branches only, highlighting the risk for end-of-life users. Ars Technica focuses on the potential for mass exploitation, citing a video of an exploit tool named PHP2Shell affecting various CMS platforms, and notes that security firm Sansec expects attacks to begin within 15 minutes of the release. Both sources agree on the CVSS 9.2 rating and the accelerated timeline but differ in emphasis: The Hacker News stresses the uncertainty of the affected version range, while Ars Technica highlights the immediate operational risks for administrators.

Why it matters

PHP powers a significant portion of the web, and critical remote code execution flaws can lead to widespread compromise of websites and applications. The lack of patches for older versions leaves a substantial portion of internet-facing hosts vulnerable, potentially enabling large-scale attacks if exploitation begins. Immediate action is required to mitigate risks before the patch release.

What to watch

PHP will release the patches at 14:00 UTC on October 21, with full details and affected versions published simultaneously. Administrators should monitor for the release, apply patches to supported versions, and isolate or upgrade end-of-life systems. Security firms expect potential exploitation attempts to begin shortly after the release, so continuous monitoring for suspicious activity is advised.