Key points
- PHP schedules an out-of-cycle release for October 21 to address two critical vulnerabilities.
- WatchTowr reports potential remote code execution flaws, but the vendor has not confirmed technical details.
- Only PHP branches 8.2 through 8.5 are eligible for the upcoming security patch.
The PHP security team announced an emergency update on October 20, 2026, to address two critical vulnerabilities rated 9.2 under CVSS v4.0. This warning urges administrators to prepare for immediate upgrades as the release is scheduled for October 21 at 14:00 UTC, according to GBHackers.
Security researchers at watchTowr reported two potential remote code execution flaws, identified as CVE-2026-109618 and CVE-2026-109619. However, the PHP maintainers have not confirmed these identifiers or the technical specifics of the vulnerabilities, The Hacker News reported. The vendor may release patches earlier if evidence of active exploitation emerges.
Context and Background
The urgency stems from a leak on October 20 that claimed the flaws affected all versions from PHP 5 onward with a CVSS score of 10.0. WatchTowr confirmed the existence of the flaws but noted the information was under embargo, according to The Hacker News. PHP’s official notice does not associate its 9.2 scores with named CVEs, leaving the connection to the reported identifiers unverified.
Who Is Affected
PHP issues fixes only for its four supported branches: 8.2, 8.3, 8.4, and 8.5. Versions 8.2 and 8.3 receive only security fixes, while 8.4 and 8.5 are in active support, The Hacker News reported. Older versions, including 8.1 and below, are end of life and will not receive a vendor patch if they are affected.
Next steps
Administrators should monitor the PHP changelog for the official release on October 21. The update will include full details on affected versions and fixed releases. Security teams should adhere to the vendor’s published schedule rather than relying on social media rumors about disclosure dates, according to GBHackers.
Signals worth monitoring
Teams usually check web server access logs for unusual POST requests or unexpected command execution patterns. Security operations centers often look for spikes in CPU usage or outbound connections from web servers that do not match normal traffic profiles. Defenders should verify whether any automated scanners are probing for known PHP endpoints. Containment moves typically involve isolating affected web servers from the internal network to prevent lateral movement while investigating the root cause.
What to do and how to stay safe: PHP
- Verify which PHP versions are running on your production servers.
- Plan to apply the October 21 update to supported branches 8.2 through 8.5.
- Monitor server logs for anomalous activity or unauthorized code execution.
- Once the vendor provides an update, test the patch in a staging environment before deployment.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are CVE-2026-109618 and CVE-2026-109619 confirmed by PHP?
No, PHP has not confirmed these identifiers or the technical details of the vulnerabilities.
Which PHP versions will receive the patch?
Only PHP branches 8.2, 8.3, 8.4, and 8.5 will receive the security update.
Is there evidence of active exploitation?
No, watchTowr reported no known exploitation occurring in the wild as of October 21.
