The PHP security team has warned users about two critical vulnerabilities and urged administrators to prepare for an upcoming security release. Both flaws carry a CVSS v4.0 score of 9.2. Updates are scheduled for Wednesday, October 21, 2026, at 14:00 UTC, giving website owners and hosting providers a short window to prepare.
In its official security notice, published on October 20, PHP said it would publish full technical details, affected versions, and fixed releases alongside the patches. The team may release updates earlier if either vulnerability becomes public or evidence of active attacks appears.
Public reporting links the upcoming fixes to CVE-2026-109618 and CVE-2026-109619. Security firm watchTowr describes them as reported remote code execution vulnerabilities, which could allow attackers to run their own code on affected servers. However, PHP’s advance notice does not name the CVEs or explain how the flaws work.
CERT-EU’s advisory also references both identifiers and warns of possible remote code execution without authentication. Its assessment draws partly on leaked information. Administrators should therefore separate these reports from the narrower facts confirmed directly by PHP.
Reports suggest the vulnerabilities could affect PHP versions from PHP 5 onward. That broad claim remains unconfirmed by the vendor. PHP has not yet established whether default installations are vulnerable, which settings are required, or whether particular operating systems face greater risk.
Some early posts described the issues as having a maximum severity score of 10.0. PHP’s published rating is 9.2 under CVSS v4.0 for each vulnerability. The official score should guide reporting until further details explain the underlying risk and attack conditions.
PHP to Issue Emergency Patch
At the time of its published update, watchTowr reported no known exploitation in the wild. PHP’s warning about a possible early release is a precaution, not confirmation that attacks have occurred. Claims involving leaked demonstrations or exploit code should not be treated as proof of attacks against real targets.
Previous incidents show why administrators should prepare quickly. Cybersecurity News documented active exploitation of CVE-2024-4577, a separate PHP flaw, with exploit attempts detected within 24 hours of disclosure. That history provides context for urgent patch planning but does not establish exploitation of these new vulnerabilities.
The publication also covered PHP SOAP extension vulnerabilities earlier in 2026. Those issues involved different components and fixes. Administrators should not assume that installing patches for earlier PHP flaws will address the two vulnerabilities covered by this upcoming release.
CERT-EU recommends identifying PHP applications now and preparing to patch affected systems as soon as fixed versions become available. Where immediate patching is not possible, organizations should consider isolating internet-facing applications from public networks until a fix can be applied. Any isolation decision should account for service availability and business needs.
Teams should use the preparation window to confirm who manages each PHP installation and how updates will reach production systems. Once the release arrives, administrators should check the official affected-version list, apply the relevant fixes promptly, and verify the running PHP version afterward. Until then, no deployment should be declared safe solely because its configuration differs from claims circulating online.
An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.
