Critical PHP Remote-Code Execution Flaws Prompt an Accelerated Patch Release

On October 20, the PHP security team announced that two remote-code execution (RCE) vulnerabilities, each rated 9.2 on the CVSS v4.0 scale, would be addressed in a critical security release. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, affect all supported PHP branches (5, 6, 7, 8). The team scheduled the patch for Wednesday, October 21, 2026, at 14:00 UTC (10:00 a.m. ET, 19:30 IST).

PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early

PHP powers major web platforms such as WordPress, Drupal, and Magento, and is widely deployed across shared-hosting environments. The most recent PHP security updates (versions 8.5.11, 8.4.26, 8.3.35, 8.2.34) were released on September 24. The newly disclosed flaws were under embargo, a coordinated period during which vendors, distributors, and security firms prepare patches before public disclosure.

PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early

• CVSS score: 9.2 (CVSS v4.0) for each vulnerability.

PHP security team sets critical patch for Oct. 21

• Affected versions: PHP 5, 6, 7, 8 (including end-of-life releases such as PHP 5 and PHP 7).

PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early

• Release timing: Originally slated for Thursday at 11 a.m. ET; now anticipated “significantly faster and swifter.”

Alert! PHP preparing to address pair of Critical RCE vulnerabilities

• Benjamin Harris, CEO of the security firm watchTowr, confirmed the leak and the reality of the vulnerabilities, stating that the firm had reproduced CVE-2026-109618 and would await the official patches before releasing further technical information.

Alert! PHP preparing to address pair of Critical RCE vulnerabilities

• watchTowr also emphasized that no exploitation in the wild had been observed and that the flaws are not listed in the CISA Known Exploited Vulnerabilities catalog.

Alert! PHP preparing to address pair of Critical RCE vulnerabilities

• Leaked posts on social media claimed the vulnerabilities scored 10.0 and described them as “zero-day” RCE bugs, but the PHP team officially rates them 9.2 under CVSS v4.0.

PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early

• The leaked disclosures did not name the CVE identifiers or specify affected functions, extensions, or configurations, whereas the upcoming release notes are expected to provide those details.

PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early

• A “Tell HN” post on October 20 cited a “reliable source” for the leak but admitted lacking evidence; the post was later flagged, leaving the precise technical nature of the flaws unverified.

PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early

• “Patches are currently unavailable, but we anticipate that the patch release will now be significantly faster and swifter than the Thursday at 11 am that was previously scheduled,” — Benjamin Harris, the company’s CEO, shared information on the developments with Cyber Daily

Alert! PHP preparing to address pair of Critical RCE vulnerabilities

The PHP security team will publish the patch at 14:00 UTC on October 21. Administrators are advised to verify their server’s PHP version before that time, plan upgrades to a supported PHP 8 branch where necessary, and apply the patches immediately upon release. The team indicated they may issue the update earlier if further details or active exploitation emerge.

PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early