Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
OpenStack Cinder through version 29.0.0 contains a vulnerability that allows cross-project information disclosure. This issue has a medium severity with a CVSS score of 4.3, indicating limited confidentiality impact without integrity or availability effects.
OpenStack Manila versions before 23.0.1 contain multiple vulnerabilities in API operations that allow an attacker with low privileges to cause a critical impact on confidentiality, integrity, and availability. The vulnerability has a very high CVSS score of 9.9, indicating severe risk. The affected versions include multiple Ubuntu package releases of Manila. No public exploit or known in-the-wild exploitation is reported. The vulnerability is classified as critical.
A vulnerability was identified in libmodulemd affecting specific versions with rpmio support enabled. The flaw has a CVSS 3.1 score of 6.2, indicating a medium severity impact primarily affecting availability. No public exploits or known active exploitation have been reported. The affected versions include several specific builds from 2.12.0-1 through 2.15.3-1. No patch or remediation details are provided in the available data.
A vulnerability was found in libmodulemd versions 2.12.0-1 through 2.15.3-1 that causes a denial of service when parsing module metadata. The flaw does not impact confidentiality or integrity but can cause service disruption due to an availability impact. The issue has a medium severity rating with a CVSS score of 6.2. No public exploits or known active exploitation have been reported. The affected versions are specifically listed and no cloud service remediation applies.
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get_model_meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
The Duplicator and Duplicator Pro WordPress plugins are vulnerable to PHP Object Injection via deserialization of untrusted data in versions up to 1.5.17 and 4.6.10 respectively. This flaw allows unauthenticated attackers to inject serialized objects into public site content, which are later processed during migration or import operations by an administrator. Exploitation can lead to remote code execution or deletion of critical files such as wp-config.php, potentially resulting in site takeover. The vulnerability requires a sequence of actions: an attacker stores malicious serialized data, an administrator creates a package, and then performs a migration or import that triggers the deserialization. No official patch information is provided in the data.
CVE-2026-113744 is a critical stack-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the formSetFirewallCfg function of the httpd Web Management Service, triggered by manipulation of the firewallEn argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed.
Golang 1.24 and related versions use system root certificates on most platforms. However, some cases exist where system trust stores may not update automatically, potentially allowing untrustworthy intermediate certificates to be accepted. To mitigate this, a denylist was added in the crypto/x509 package to reject verification attempts involving known untrustworthy intermediate certificates.
Astral uv versions 0.9.17+ds1-3 through 0.9.17+ds1-6 contain a path traversal vulnerability that could allow an attacker to access files outside the intended directory. This vulnerability has a medium severity with a CVSS score of 5.3. No public exploit code or active exploitation in the wild has been reported. The vulnerability affects specific versions prior to 0.11.6.
The uv software versions before 0.11.15 contain a path traversal vulnerability that can be exploited to compromise system confidentiality, integrity, and availability. This vulnerability is rated high severity with a CVSS score of 8.8. The affected versions include specific builds of 0.9.17+ds1-3 through 0.9.17+ds1-6. No public exploits or vendor patch information is provided in the data.
FreeRDP versions before 3.32.0 contain a null-pointer dereference vulnerability that can cause a denial of service. The flaw affects multiple Ubuntu package versions of FreeRDP. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with no confidentiality or integrity impact but potential availability impact.
FreeRDP versions before 3.32.1 contain a heap-based buffer overflow vulnerability in the server component. This flaw allows an attacker with local privileges to potentially execute arbitrary code or cause a denial of service. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
FreeRDP versions before 3.32.1 contain a heap out-of-bounds read vulnerability that can lead to information disclosure. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. It affects multiple specific Ubuntu package versions of FreeRDP. No public exploits or known active exploitation have been reported.
FreeRDP version 3.32.0 contains a use-after-free vulnerability in the drdynvc component. This vulnerability can cause a denial of service by crashing the affected system. The issue has a CVSS score of 6.5, indicating a medium severity level. Multiple specific Ubuntu package versions of FreeRDP are affected.
A vulnerability was found in device-mapper-multipath (multipath-tools) affecting specific Ubuntu package versions. The flaw allows a local user to trigger an issue that impacts confidentiality and availability with no privileges required. The CVSS score is 5.1, indicating a medium severity level.
Astral uv versions before 0.8.22 contain a path traversal vulnerability that allows unauthorized modification of data. This vulnerability has a CVSS score of 6.5, indicating a medium severity level. The affected versions include specific builds of version 0.9.17+ds1. There is no indication of public exploits or active exploitation in the wild. No patch or remediation details are provided in the available data.
Mandiant FLARE capa versions prior to 10.0.0 contain a deserialization vulnerability (CWE-502) that allows arbitrary code execution when processing crafted .viv or .exe.viv workspace files. This vulnerability is fixed in version 10.0.0.
Trigger.dev versions prior to 4.5.10 contain a server-side request forgery (SSRF) vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the 198.18.0.0/15 benchmarking IP range. This enables attackers to perform blind internal probing and limited state-changing POST requests to internally routed services within this range.