PHP's security team has warned administrators to prepare for emergency patches on Wednesday, October 21, 2026, at 14:00 UTC. The updates fix two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. BleepingComputer reported the warning on October 20.
The disclosure was meant to stay embargoed until Thursday, October 22. Information leaked early, including a Hacker News post that was later deleted. PHP says it may ship the fixes sooner if details become public or if exploitation is observed.
Severity is disputed. PHP's own advisory scores each flaw 9.2 under CVSS v4.0. The leaked post and watchTowr describe them as CVSS 10.0. Affected versions are not confirmed by PHP. watchTowr believes they reach PHP 5, 6, 7 and 8. PHP has said it will publish affected and fixed versions with the release.
No technical detail is public. watchTowr says it reproduced CVE-2026-109618 and will hold its write-up until patches ship. It has not observed exploitation in the wild. That window is short. Once fixes land, patch diffing typically yields working exploits within days.
Why it matters: PHP sits behind a large share of the web, including WordPress, Laravel and many legacy internal apps. Unauthenticated or low-privilege RCE in the runtime would put every internet-facing PHP host at risk.
What to do now. Inventory every PHP runtime in your estate, including containers, base images and shared hosting. Identify which are internet-facing. Schedule an out-of-band change window for the afternoon of October 21. Pull the vendor and distro advisories as soon as they publish. Until then, make sure WAF logging and process-spawn telemetry on PHP hosts are working, so post-patch hunting for web shells and unexpected child processes is possible.
