PHP Security Team Accelerates Release to Patch Leaked RCE Zero-Days
The PHP security team announced an emergency release for October 21 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, after details of the embargoed flaws leaked online. Rated 9.2 under CVSS v4.0, these remote code execution bugs affect PHP core. The release was moved up from the originally planned Thursday to Wednesday to mitigate risks from the premature disclosure.
Key points
- PHP Foundation scheduled a security release for October 21 at 14:00 UTC to address two critical flaws.
- The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the CVSS v4.0 scale.
- Information regarding the embargoed flaws leaked on October 20, prompting the accelerated timeline.
- Security firm watchTowr confirmed the leaks involve real zero-day remote code execution vulnerabilities.
- No active exploitation has been observed, and no workarounds exist prior to the patch release.
- PHP 5 and 7 are end-of-life and will not receive official fixes, leaving those systems exposed.
Background
This incident follows a series of critical remote code execution vulnerabilities disclosed in late 2026, including active exploitation of Citrix NetScaler flaws in September and GitLab CI/CD regex compiler issues in October. The current PHP leak mirrors previous patterns where embargoed details surfaced before official advisories, forcing vendors to accelerate patch deployments to protect users of widely adopted software like WordPress and Drupal.
Why it matters
PHP powers a significant portion of the web, including major platforms like WordPress and Drupal. A core remote code execution flaw that can be exploited without authentication poses a severe risk to millions of websites. The leak of embargoed details compromises the coordinated disclosure process, potentially allowing attackers to prepare exploits before patches are widely deployed. Administrators must prioritize upgrading to supported PHP 8 branches to mitigate this risk.
What to watch
The PHP security team will publish full details, affected versions, and fixed versions at 14:00 UTC on October 21. Administrators should prepare to upgrade immediately upon release. The team may ship the patch earlier if evidence of active exploitation emerges. Users of end-of-life PHP 5 and 7 versions must migrate to supported branches as no fixes will be provided for them.
Want the full story? Read the original reporting
Read on Cyber Kendra