PHP Rushes Out-of-Cycle Fix for Two Critical RCE Flaws

PHP will ship an out-of-cycle security release today, October 21, at 14:00 UTC. It closes two critical vulnerabilities the project's security team has rated 9.2 on the CVSS v4.0 scale but has not yet described. Researchers at watchTowr say both flaws allow remote code execution. No exploitation has been reported so far.

A leak got ahead of the announcement

The warning did not come out of nowhere. On October 20 a post on Hacker News claimed two PHP RCE flaws rated 10.0, supposedly affecting every version since PHP 5, would be disclosed on October 22. The poster candidly admitted there was no evidence "beyond 'source: trust me, bro'." watchTowr soon confirmed on X that the information was genuine, that the flaws were under embargo, and that no one was supposed to speak before Thursday. That same evening, at 19:33 UTC, PHP published its own notice, setting the release a day earlier than the date watchTowr had given.

What is known, and what isn't

The leak carried the existence of the flaws, a score, a date and two CVE identifiers (CVE-2026-109618 and CVE-2026-109619), but not how they work. The 10.0 figure is the leak's; PHP's own rating is 9.2. The name php2shell is the researchers', not the project's. The claim that everything from PHP 5 onward is affected is also unconfirmed: watchTowr's own FAQ notes that scope has not been confirmed by an official vendor advisory.

Who gets the fix

The patch will land only for the four supported branches: 8.2 and 8.3 receive security fixes only, while 8.4 and 8.5 are in active support. Anything older — 8.1, 8.0, 7.x and 5.x — is end of life and gets no official patch. Security firm Mallory counted roughly 884,000 internet-facing hosts whose HTTP banners reported PHP 8.1 or older, about 59% of the roughly 1.5 million hosts that reported any version at all.

What to do before the release

PHP has published no workaround. The advice amounts to inventorying every PHP install (including those bundled in control panels such as cPanel and Plesk), being ready to upgrade at 14:00 UTC with internet-facing systems first, and for end-of-life branches, taking them off the public network behind a VPN or WAF. Watch for suspicious processes spawned by php-fpm or php-cgi: shells, interpreters, download tools. For comparison, when CVE-2024-4577 became public in June 2024, Akamai saw exploit attempts against its honeypots within 24 hours.

Source: The Hacker News