Story perspectives

PHP Zero-Day Patches Scheduled October 21 for RCE Flaws

By Drooid · Oct 21, 2026, 2:01 AM UTC · How we work

Summary

Story summary

The U.S. PHP security team scheduled a critical release for October 21 to fix two vulnerabilities.
Both CVE-2026-109618 and CVE-2026-109619 received CVSS v4.0 scores of 9.2.
The flaws are remote-code-execution zero-days affecting PHP versions 5, 6, 7 and 8.
Security firm watchTowr confirmed the leaks and reproduced CVE-2026-109618.
watchTowr said patches are unavailable but will arrive sooner than the originally planned Thursday 11 a.m. ET.

1 of 1

Story summary

The U.S. PHP security team scheduled a critical release for October 21 to fix two vulnerabilities.
Both CVE-2026-109618 and CVE-2026-109619 received CVSS v4.0 scores of 9.2.
The flaws are remote-code-execution zero-days affecting PHP versions 5, 6, 7 and 8.
Security firm watchTowr confirmed the leaks and reproduced CVE-2026-109618.
watchTowr said patches are unavailable but will arrive sooner than the originally planned Thursday 11 a.m. ET.