PHP Maintainers Accelerate Emergency Patch Release for Leaked Critical RCE Flaws

Key points

• PHP maintainers scheduled emergency patches for October 21 at 14:00 UTC, moving the release up from the originally planned Thursday to address two critical vulnerabilities.
• The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 under CVSS v4.0 by the PHP team, though some security firms and leaked reports claim a CVSS score of 10.0.
• Leaked details suggest the flaws enable remote code execution on PHP versions 5, 6, 7, and 8, impacting major platforms like WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, Drupal, and WHMCS.
• Security firm watchTowr confirmed the vulnerabilities are real and reproduced one of them, while Sansec warned that mass attacks could begin within 15 minutes of the patch release.
• Administrators are advised to identify responsible parties, inventory PHP applications, plan maintenance windows, backup data, and monitor for early release announcements, with some experts recommending disconnecting non-essential systems until patched.

Background

This incident follows a broader trend of critical vulnerabilities in widely used web technologies, as seen in the recent eMudhra certificate compromise that forced emergency browser patches. The accelerated PHP release mirrors previous emergency responses to leaked zero-day vulnerabilities, highlighting the ongoing challenge of managing disclosure timelines when information leaks prematurely. The impact of these flaws is significant given PHP's role as a foundational technology for a large portion of the web, with an estimated 1.3 million internet-connected hosts potentially affected.

How outlets are covering it

Ars Technica emphasizes the severity and urgency of the situation, noting the potential for major damage across the internet and the need for immediate preparation by administrators. BleepingComputer highlights the discrepancy between the PHP team's CVSS rating of 9.2 and the CVSS 10.0 score claimed by watchTowr and a leaked Hacker News post, as well as the difference in the originally planned disclosure date. RuntimeWire's content was inaccessible due to a bot challenge, so no perspective could be extracted from that source. All sources agree on the critical nature of the vulnerabilities and the accelerated patch release, but differ in their assessment of the exact severity score and the timeline of the original disclosure.

Why it matters

The potential for widespread exploitation of these critical PHP vulnerabilities poses a significant risk to the stability and security of a large portion of the internet. The accelerated patch release and the warning of imminent mass attacks underscore the importance of rapid response by administrators and the need for robust security practices. The incident also highlights the challenges of managing vulnerability disclosures in the face of premature leaks, which can exacerbate the risk of exploitation.

What to watch

Administrators should monitor the PHP.net homepage for any late-breaking announcements, including an earlier release time, and be prepared to apply patches as soon as they are available. Security firms expect mass attacks to begin shortly after the patch release, so organizations should have contingency plans in place. The PHP team will publish full technical details, affected versions, and fixed releases when the security updates become available.