Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.
The Duplicator and Duplicator Pro WordPress plugins are vulnerable to PHP Object Injection via deserialization of untrusted data in versions up to 1.5.17 and 4.6.10 respectively. This flaw allows unauthenticated attackers to inject serialized objects into public site content, which are later processed during migration or import operations by an administrator. Exploitation can lead to remote code execution or deletion of critical files such as wp-config.php, potentially resulting in site takeover. The vulnerability requires a sequence of actions: an attacker stores malicious serialized data, an administrator creates a package, and then performs a migration or import that triggers the deserialization. No official patch information is provided in the data.
Dulwich versions from 0.22.5 up to but not including 1.2.8 contain a path traversal vulnerability. This flaw allows an attacker with local access and user interaction to potentially read, modify, or delete files outside the intended directory. The vulnerability has a high severity rating with a CVSS score of 7.8. Multiple specific package versions, including various Ubuntu builds, are affected.
Astral uv versions before 0.8.22 contain a path traversal vulnerability that allows unauthorized modification of data. This vulnerability has a CVSS score of 6.5, indicating a medium severity level. The affected versions include specific builds of version 0.9.17+ds1. There is no indication of public exploits or active exploitation in the wild. No patch or remediation details are provided in the available data.
Vyper versions 0.3.8 through 0.5.0b1 contain an optimizer miscompilation bug that causes certain ternary expressions involving bitwise OR operations with nonzero integer literals to be incorrectly compiled to the constant 1. This flaw leads to incorrect values being used in storage writes, arithmetic operations, indexes, return values, or events, potentially causing deposits to be recorded incorrectly and funds to be locked without warning or revert.
Trigger.dev versions before 4.5.6 deployed via self-hosted Docker Compose with default secrets allow authentication bypass due to a hardcoded MAGIC_LINK_SECRET. This enables unauthenticated attackers to forge valid magic link tokens, log in as any email address, and access backend services like Postgres, Redis, and ClickHouse using default credentials, compromising all tenant data.
Trigger.dev versions prior to 4.5.6 have an authorization bypass vulnerability in the DeleteTaskScheduleService and SetActiveOnTaskScheduleService components. This flaw allows authenticated users to delete or disable schedules belonging to other organizations by exploiting user-controlled keys. Attackers can misuse their own project's schedule route with a victim's schedule friendlyId to manipulate and destroy other organizations' imperative cron schedules.
Trigger.dev versions prior to 4.5.10 contain a server-side request forgery (SSRF) vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the 198.18.0.0/15 benchmarking IP range. This enables attackers to perform blind internal probing and limited state-changing POST requests to internally routed services within this range.
An information leak vulnerability exists in ANGLE component of Google Chrome on Windows versions prior to 156.0.8078.47. This flaw allows a remote attacker to leak sensitive information by convincing a user to visit a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-113737 is a path traversal vulnerability in the R6410418 Jackrong-llm-finetuning-guide project affecting the validate_indexed_tensors function in the qwen_mtp_gguf_pipeline.py script. Manipulation of the weight_map argument can lead to path traversal, potentially exploitable remotely. The project uses a rolling release system, so specific affected or fixed versions are not disclosed. The vulnerability has a medium severity score of 5.1 and public exploit code is available. The vendor has been informed but has not yet responded or issued a fix.
CVE-2025-60490 is a heap use-after-free vulnerability in the gf_filter_pid_send_event_downstream function of GPAC Project/MP4Box before version 2.5. This flaw allows attackers to cause a denial of service (DoS) by supplying a specially crafted MP4 file. The issue is fixed in version 2.5.
CVE-2025-60478 is a use-after-free vulnerability in the gf_filter_packet_destroy function of GPAC Project/MP4Box before version 2.5. This flaw can be triggered by processing a crafted MPEG-2 file, leading to a denial of service (DoS) condition. The issue is fixed in version 2.5.
CVE-2025-60497 is a medium severity vulnerability in GPAC Project/MP4Box before version 2.5. It involves a segmentation violation in the GetESD function within the /isomedia/track.c file. An attacker can trigger a Denial of Service (DoS) by supplying a crafted MP4 file. The issue is fixed in version 2.5.
CVE-2025-71438 is an out-of-bounds read vulnerability in the GPAC Project's MP4Box component prior to version 26.07.0. The flaw exists in the gf_odf_ac4_cfg_dsi_v1 function within the /odf/descriptors.c file. An attacker can trigger a denial of service (DoS) by supplying a specially crafted AC4 file. This vulnerability has a medium severity rating with a CVSS score of 5.5. The issue is fixed in version 26.07.0.
CVE-2026-113707 is a race condition vulnerability in the a2aproject a2a-rs software, specifically in the InMemoryTaskStore::update function within the a2a-server/src/task_store/inmemory.rs file. This flaw affects versions 0.4.0 through 0.4.4 and can be exploited remotely. The vulnerability has a medium severity rating with a CVSS score of 5.3. A patch identified by commit 7050c7d329238539424ee46440e23b91c4825bee is available to address this issue.
CVE-2026-109682 is a server-side request forgery (SSRF) vulnerability in Rapid7 Metasploit Framework versions before 6.5.7. It allows HTTP requests made via the send_request_cgi! method to follow redirects to arbitrary hosts without restriction. This can enable a malicious HTTP server to induce the Metasploit operator's system to access internal or otherwise inaccessible HTTP services.