The PHP security team scheduled a security release for October 21, 2026 at 14:00 UTC to address the two flaws.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
No technical details about the vulnerabilities have been made public.
watchTowr confirmed the vulnerabilities are real after details leaked ahead of the planned coordinated disclosure.
An emergency advisory from CERT-EU, published October 20, 2026, warns of two critical PHP flaws that could let attackers run code on servers, known as remote code execution.
The flaws carry the identifiers CVE-2026-109618 and CVE-2026-109619, and PHP rated both flaws 9.2 under CVSS v4.0; CVSS scores vulnerabilities on a severity scale. The PHP security team scheduled the fix for both flaws on October 21, 2026 at 14:00 UTC. The PHP security team reserved the right to ship the update early if details leak or intruders begin exploiting the flaws.
No technical details about the flaws are public, and attackers have not been observed actively exploiting the vulnerabilities. The flaws could affect every PHP version from PHP 5 onward, including versions 5, 6, 7, and 8; Threat Landscape says patches will not cover PHP 5 and PHP 7 systems.
PHP’s official CVSS v4.0 rating of 9.2 conflicts with the CVSS 10.0 score given by watchTowr and a Hacker News post. watchTowr confirmed the flaws are real following a leak ahead of coordinated disclosure. watchTowr said, “Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they’re real.” watchTowr said it reproduced CVE-2026-109618, though it will not share technical information until patches exist, and the researcher said it did not discover the flaws, leaving credit to the original researchers.
PHP is used by a large number of websites and web applications, including content management systems, online stores, and custom web services. User petecooper’s now-removed Hacker News post claimed disclosure would come on October 22, 2026 at 18:00 CEST. An originally planned Thursday disclosure was cited by watchTowr and the Hacker News post.
CERT-EU advises patching affected assets immediately once fixed versions are available. If patching cannot happen right away, CERT-EU recommends moving internet-facing PHP applications off public networks until a fix exists. Threat Landscape recommends inventorying all PHP instances, moving PHP 5 and PHP 7 systems to a supported PHP 8 branch, and watching php.net and vendor channels. Fixed releases, affected version ranges, and full technical information will be part of the release.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Join the discussion