PHP schedules emergency release for two severe vulnerabilities
The PHP project plans to publish emergency security updates on October 21 for two vulnerabilities rated 9.2 under CVSS v4.0. watchTowr said the issues are remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619, reportedly affecting PHP 5 through 8, and that details leaked before the planned disclosure. No active exploitation had been observed when the warning was issued.
The PHP team said it would issue fixes on October 21 at 14:00 UTC, with a mailing-list notice telling administrators to be ready to install them promptly. It withheld exploit mechanics, affected releases, and which versions would receive patches.
watchTowr reported that the two flaws are remote code execution issues and said it had reproduced one, while holding back technical details until patches exist. It also said no in-the-wild exploitation had been seen when the warning was issued. PHP is widely used by websites, online shops, and custom web services.
Because PHP underpins many public websites, online stores, and internal web tools, a remote code execution flaw could put a broad range of organizations at risk if exploited. Administrators may face urgent patching under time pressure, and leaked details could increase the chance of attempts before fixes are broadly applied. The potential impact includes compromised servers, exposed data, and disrupted services, though no active exploitation had been reported when the warning was issued.