PHP Accelerates Emergency Patch Release for Leaked Critical RCE Flaws

Key points

• PHP security team scheduled an emergency release for 14:00 UTC on October 21, 2026, to address two critical vulnerabilities.
• The flaws, identified as CVE-2026-109618 and CVE-2026-109619, were leaked before the originally planned October 22 disclosure.
• PHP rates the vulnerabilities 9.2 on the CVSS v4.0 scale, while some researchers initially cited a CVSS 10.0 score.
• Security firm watchTowr confirmed the flaws are real and potentially affect PHP versions 5 through 8, though PHP has not officially confirmed the affected range.
• No active exploitation has been reported in the wild as of October 20, but security firms warn mass attacks could begin shortly after the patch release.
• Only PHP versions 8.2 through 8.5 will receive official fixes; older end-of-life versions will not be patched by the vendor.

Background

This incident follows a broader trend of critical infrastructure vulnerabilities, including recent patches for NGINX and Atlassian products. PHP remains a foundational technology for many web applications, making unpatched critical flaws a significant risk for internet-facing systems.

How outlets are covering it

BleepingComputer and The Hacker News emphasize the premature leak of vulnerability details, which forced PHP to accelerate the patch release. Ars Technica highlights the potential for mass exploitation, citing a security firm's warning that attacks could begin within 15 minutes of the patch release. Rescana focuses on the lack of official technical details and the need for administrators to inventory all PHP installations, including those in vendor appliances. All sources agree that no active exploitation has been confirmed, but they differ on the severity rating, with PHP using CVSS v4.0 9.2 and some researchers citing CVSS 10.0.

Why it matters

PHP powers a significant portion of the internet's web applications, including content management systems and e-commerce platforms. Critical RCE flaws in PHP could allow attackers to execute arbitrary code on vulnerable systems, potentially leading to data breaches, service disruptions, and further exploitation. The lack of patches for older PHP versions leaves many systems exposed, making this a high-priority issue for administrators.

What to watch

PHP is expected to release the security patches at 14:00 UTC on October 21, 2026, or earlier if exploitation is detected. Administrators should monitor php.net for updates, prepare maintenance windows, and isolate internet-facing applications if patching cannot be done immediately. Security firms will likely update their advisories with technical details and indicators of compromise once the patches are released.