PHP maintainers are preparing an emergency security release for two critical vulnerabilities that could enable remote code execution, urging users to be ready to update as soon as fixes are published. The release is scheduled for October 21 at 14:00 UTC, according to the PHP security announcement.
PHP rates both flaws 9.2 under CVSS v4.0. The vendor has not yet published technical details, affected-version ranges or fixed-version numbers, and its announcement does not identify the vulnerabilities by CVE number. Security reporting and third-party advisories nevertheless associate the release with CVE-2026-109618 and CVE-2026-109619. CERT-EU says the pair could affect PHP versions dating from PHP 5 onward and may permit unauthenticated remote code execution, but cautions that no technical details were publicly available when it issued its alert. CERT-EU’s advisory lists both identifiers and the 9.2 scores.
The disclosure has been complicated by leaked information ahead of the coordinated release. Researchers at watchTowr have publicly said the vulnerabilities are real and remotely exploitable, while reports describe them as PHP-core flaws affecting multiple major branches. Those claims have not been accompanied by a PHP technical advisory confirming the vulnerability mechanics. A GitHub repository also claims to contain a working exploit chain, but that material is not an authoritative vendor confirmation and should be treated as untrusted until independently validated.
There is no verified evidence in the available official advisories that either flaw is being exploited in the wild, and neither vulnerability has been established here as a CISA Known Exploited Vulnerability. PHP’s announcement says it could move the release earlier if exploitation evidence emerges, underscoring the narrow window defenders face while details remain embargoed or incomplete.
Administrators should inventory internet-facing applications and hosting systems that run PHP, prepare maintenance windows and apply the vendor’s fixed releases immediately after publication. Where immediate patching is impossible, CERT-EU recommends isolating affected internet-facing applications from public networks. Defenders should also monitor PHP’s official release notice for the final CVE details, affected branches, fixed versions and remediation guidance rather than relying on leaked proof-of-concept material.
