Key facts
- The PHP security team scheduled a security release for October 21, 2026 at 14:00 UTC to address the two flaws.
- The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
- No technical details about the vulnerabilities have been made public.
- watchTowr confirmed the vulnerabilities are real after details leaked ahead of the planned coordinated disclosure.
An emergency advisory from CERT-EU, published October 20, 2026, warns of two critical PHP flaws that could let attackers run code on servers, known as remote code execution.
The flaws carry the identifiers CVE-2026-109618 and CVE-2026-109619, and PHP rated both flaws 9.2 under CVSS v4.0; CVSS scores vulnerabilities on a severity scale. The PHP security team scheduled the fix for both flaws on October 21, 2026 at 14:00 UTC. The PHP security team reserved the right to ship the update early if details leak or intruders begin exploiting the flaws.
No technical details about the flaws are public, and attackers have not been observed actively exploiting the vulnerabilities. The flaws could affect every PHP version from PHP 5 onward, including versions 5, 6, 7, and 8; Threat Landscape says patches will not cover PHP 5 and PHP 7 systems.
PHP’s official CVSS v4.0 rating of 9.2 conflicts with the CVSS 10.0 score given by watchTowr and a Hacker News post. watchTowr confirmed the flaws are real following a leak ahead of coordinated disclosure. watchTowr said, “Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they’re real.” watchTowr said it reproduced CVE-2026-109618, though it will not share technical information until patches exist, and the researcher said it did not discover the flaws, leaving credit to the original researchers.
PHP is used by a large number of websites and web applications, including content management systems, online stores, and custom web services. User petecooper’s now-removed Hacker News post claimed disclosure would come on October 22, 2026 at 18:00 CEST. An originally planned Thursday disclosure was cited by watchTowr and the Hacker News post.
CERT-EU advises patching affected assets immediately once fixed versions are available. If patching cannot happen right away, CERT-EU recommends moving internet-facing PHP applications off public networks until a fix exists. Threat Landscape recommends inventorying all PHP instances, moving PHP 5 and PHP 7 systems to a supported PHP 8 branch, and watching php.net and vendor channels. Fixed releases, affected version ranges, and full technical information will be part of the release.
Join the discussion