PHP Security Team Warns of Two Critical RCE Vulnerabilities Ahead of Emergency Update

The PHP Security Team is warning administrators to prepare for an emergency security update addressing two critical remote code execution vulnerabilities. Details about the flaws reportedly leaked before the planned disclosure.

PHP powers millions of websites and web applications, including content management systems, e-commerce platforms, and custom web services. Administrators should be ready to install the security updates as soon as they are released.

PHP emergency security update scheduled for October 21

In recommendations released Tuesday, the PHP development team announced that it plans to publish a security update addressing two vulnerabilities on Wednesday, October 21, at 14:00 UTC (10:00 a.m. ET).

The PHP Security Team also sent a notice to the ANNOUNCE mailing list urging administrators to prepare to apply the security updates immediately after they become available.

“We reserve the right to release early if details of the vulnerability become public or evidence of active exploitation comes to light,” the PHP Security Team warned.

PHP has not yet disclosed technical details, including the affected versions, exploitation methods, or the releases that contain the fixes.

Two PHP remote code execution vulnerabilities reportedly leaked

Security researchers at watchTowr told BleepingComputer that the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. The researchers said the flaws are remote code execution vulnerabilities believed to affect PHP versions 5, 6, 7, and 8.

“In the past hour, two PHP remote code execution vulnerabilities have been leaked. These vulnerabilities were previously embargoed and scheduled for release on Thursday at 11 a.m. ET,” watchTowr CEO Benjamin Harris told BleepingComputer.

“For obvious reasons, we are unable to share technical information at this time, but due to sensitivity considerations we can confirm that these vulnerabilities do exist. Both are CVSS 10 and are understood to affect PHP versions 5, 6, 7, and 8.”

watchTowr said it believes it successfully reproduced CVE-2026-109618 but will not release technical information until a security patch is available.

The researchers clarified that they have not observed any exploitation of the vulnerabilities, despite the reported leak before the planned disclosure.

In a post on X, watchTowr warned that information about the PHP vulnerabilities had been leaked before the originally scheduled publication date.

“We were supposed to wait until Thursday at 11 a.m. ET. Information about zero-day embargoed RCE vulnerabilities in PHP was leaked. We can confirm that they are real,” the researchers said.

PHP vulnerability details and severity scores differ

The warning follows a now-deleted post on Y Combinator’s Hacker News forum. A user named “petecooper” claimed that two critical PHP remote code execution vulnerabilities would be disclosed on October 22.

The post, reviewed by BleepingComputer, claimed that both vulnerabilities had a CVSS score of 10.0 and affected PHP versions dating back to PHP 5. It also identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, matching the identifiers later shared by watchTowr.

However, watchTowr’s statement and the Hacker News post differ from PHP’s official announcement. While both describe the vulnerabilities as CVSS 10.0, the PHP Security Team assigned each flaw a CVSS v4.0 score of 9.2.

There is also a difference in the reported release schedule. watchTowr cited an originally scheduled Thursday rollout, while PHP’s official announcement schedules the security release for Wednesday morning.

What PHP administrators should do now

Administrators should monitor the official PHP channels and prepare to update affected systems as soon as the security releases become available. The PHP Security Team says it will publish full technical details, affected versions, and fixed releases alongside the security updates.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report