PHP Warns Administrators of Two Critical Flaws, Emergency Patches Coming Tomorrow

The PHP Security Team is warning admins to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws was reportedly leaked ahead of their scheduled disclosure.

PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services.

In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21 at 2:00 p.m. UTC (10:00 a.m. Eastern), to fix two vulnerabilities, each rated 9.2 under CVSS v4.0.

The PHP Security Team also sent a notice to its ANNOUNCE mailing list, urging administrators to prepare to install security updates as soon as they become available.

“We reserve the right to publish sooner if details of either vulnerability become public or if evidence of active exploitation appears in the wild,” the PHP security team warned.

The developers have not disclosed any technical details about the vulnerabilities, including which versions of PHP are affected, how they can be exploited, or which versions will contain fixes.

However, security researchers at watchTowr told BleepingComputer that the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are remote code execution (RCE) flaws believed to affect PHP versions 5, 6, 7, and 8.

“In the last hour, two remote code execution vulnerabilities in PHP were disclosed. These vulnerabilities were previously scheduled to be embargoed and were scheduled to be released on Thursday at 11 a.m. ET,” Benjamin Harris, CEO of watchTowr, told BleepingComputer.

“While we are unable to share technical information at this stage for obvious reasons, given their sensitivity, we can confirm that these vulnerabilities are indeed real. Both are CVSS10 and are believed to affect PHP versions 5, 6, 7 and 8.”

watchTowr also said it believed it had successfully reproduced CVE-2026-109618, but would not release technical information until security patches were available.

The researchers clarified that they did not observe exploitation of the vulnerabilities in the wild, despite the information reportedly leaking ahead of the planned disclosure.

In an article on X, watchTowr warned that information about the vulnerabilities had been disclosed before the originally planned disclosure date.

“We were all supposed to wait until Thursday at 11:00 a.m. ET. Information has leaked regarding zero-day embargoed RCE vulnerabilities in PHP. We can confirm that they are real,” the researchers said.

The warning follows a now-deleted post on Y Combinator’s Hacker News forum, in which a user named “petecooper” claimed that two critical PHP remote code execution vulnerabilities would be disclosed on October 22.

The post, seen by BleepingComputer, claimed that both vulnerabilities had CVSS scores of 10.0 and affected PHP versions going back to PHP 5.

It also identified vulnerabilities CVE-2026-109618 and CVE-2026-109619, matching the credentials that watchTowr later shared.

However, watchTowr’s statements and Hacker News’ post are different from PHP’s official announcement. Both described the vulnerabilities as CVSS 10.0, while the PHP Security Team gave each a CVSS v4.0 score of 9.2.

Additionally, watchTowr cited a disclosure originally scheduled for Thursday, while PHP has officially scheduled its security release for tomorrow morning.

The PHP Security Team states that they will release full technical details, affected versions, and patched versions when security updates become available.