PHP preps emergency patches after two critical flaws leak early

The PHP security team has warned administrators to prepare for emergency updates addressing two critical vulnerabilities. The urgency stems from a leak: information about the flaws spread ahead of the scheduled disclosure.

PHP underpins a vast number of websites and web applications — from content management systems and e-commerce platforms to custom services — so any serious flaw reaches a large slice of the internet.

What is known

In an advisory published Tuesday, the developers said they would ship updates on Wednesday, October 21, at 14:00 UTC. Each of the two vulnerabilities carries a score of 9.2 under CVSS v4.0. A matching notice went out on the ANNOUNCE mailing list, urging admins to install the fixes as soon as they appear.

"We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the team said.

The developers have disclosed no technical details — neither the affected versions, nor how the flaws can be exploited, nor which releases will carry the fixes.

Details from researchers

Researchers at watchTowr told BleepingComputer that the issues are remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619, and that they believe PHP versions 5, 6, 7, and 8 are affected.

watchTowr CEO Benjamin Harris confirmed the vulnerabilities are real and said the firm had successfully reproduced CVE-2026-109618, but it is withholding technical information until patches land. The researchers have not observed any in-the-wild exploitation despite the leak.

The leak appears to trace back to a now-deleted Hacker News post. A user named "petecooper" claimed two critical PHP RCE flaws would be disclosed on October 22, citing the same identifiers watchTowr later shared.

Discrepancies

The watchTowr statements and the Hacker News post diverge from PHP's official announcement. Both described the flaws as CVSS 10.0, while the PHP team assigned each a CVSS v4.0 score of 9.2. The leak also pointed to a Thursday disclosure, whereas the official release is set for Wednesday morning.

PHP says it will publish full technical details, affected versions, and fixed releases once the updates are available.

Source: Bleeping Computer