Science & Tech · Cybersecurity · 1 hr ago
PHP plans urgent patches for two critical security flaws
PHP plans to release urgent security patches at 14:00 UTC on October 21 for two vulnerabilities.
The flaws each have an official severity score of 9.2 out of 10, which is classified as critical.
The affected PHP versions are not yet confirmed, and the project says it will publish details and fixed versions with the updates.
PHP runs behind many websites and web applications, including WordPress sites, so vulnerable systems could put online services at risk.
Researchers and an EU security agency have suggested the flaws may allow remote code execution and could affect older PHP versions, but those details have not been confirmed by the PHP team.
Some reports say information about the flaws leaked early, and PHP may release patches sooner if details become public or evidence of attacks appears.
Administrators are being told to prepare updates now and apply them as soon as the fixes are released.
PHP plans to release emergency security updates on Wednesday, October 21, 2026, at 14:00 UTC to fix two critical vulnerabilities.
Each flaw has an official severity score of 9.2 under CVSS v4.0.
The PHP security team has not yet disclosed the affected versions or technical details and says it will publish them with the fixes.
The team urges administrators to prepare to apply updates promptly and says it may release them earlier if details become public or active exploitation is found.
Security researchers and CERT-EU have reported that the flaws may affect older PHP versions, but those claims have not been confirmed by PHP.
- Who
- The PHP security team is preparing the updates. PHP administrators are urged to get ready to install them.
- What
- Two critical vulnerabilities are due to be fixed in emergency security updates.
- When
- Wednesday, October 21, 2026, at 14:00 UTC. The team may release the updates earlier.
- Where
- PHP installations, including those used by websites and web applications.
- Why
- The updates are intended to fix two vulnerabilities rated 9.2 under CVSS v4.0.
PHP security team
watchTowr researchers
Severity
PHP security team
PHP rates each flaw 9.2 under CVSS v4.0.
watchTowr researchers
watchTowr described both flaws as CVSS 10.0.
Affected versions
PHP security team
PHP has not yet disclosed which versions are affected.
watchTowr researchers
watchTowr said the flaws are understood to affect PHP versions 5, 6, 7 and 8.
Disclosure timing
PHP security team
PHP scheduled the release for Wednesday, October 21, at 14:00 UTC, while reserving the right to release earlier.
watchTowr researchers
watchTowr said the flaws had originally been scheduled for disclosure on Thursday at 11 am ET.
The PHP development team announced a planned security release for the following day.
A now-deleted Hacker News post claimed the vulnerabilities would be disclosed on October 22.
watchTowr said information about the vulnerabilities had leaked and reported that it had reproduced one flaw.
PHP scheduled the security updates and publication of details about the vulnerabilities and fixes.
- Planned release
- October 21, 2026, at 14:00 UTC
- Number of vulnerabilities
- 2
- Official severity
- 9.2 each under CVSS v4.0
- Vulnerability identifiers
- CVE-2026-109618 and CVE-2026-109619
- Affected versions
- Not yet disclosed by PHP
4 sources
What people are saying
We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,
In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET,
We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real,
Posts on X
We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619 We cannot share further information right now. Take this seriously and apply patches when available.