PHP warns admins of two critical flaws, emergency patches coming tomorrow

Two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, have been announced by the PHP security team. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and reportedly affect PHP versions 5 through 8. The PHP team plans to release emergency security updates on October 21, 2026, at 14:00 UTC. Technical details, affected versions, and patches have not been published yet. The vulnerabilities were leaked ahead of the scheduled disclosure, but no exploitation in the wild has been confirmed. Security researchers have reproduced one of the flaws but are withholding technical information until patches are released.

Successful exploitation of these vulnerabilities could allow remote code execution on affected PHP installations, potentially leading to full system compromise. Given the critical severity and the nature of PHP as a widely used web scripting language, the impact could be significant across many web applications and services. No active exploitation has been reported so far.

Administrators should prepare to apply the official security updates immediately upon their release on October 21, 2026. No technical mitigations or workarounds have been provided at this time. Monitoring the PHP official channels for the release of patches and detailed advisories is essential. The PHP security team has not indicated any action required before the patch release.