PHP warns admins of two critical flaws, emergency patches due next day
The PHP security team said it would ship emergency updates for two vulnerabilities rated 9.2 under CVSS v4.0, after details reportedly leaked ahead of the planned disclosure.
The PHP security team told administrators to prepare for emergency security updates, saying it planned to publish them on Wednesday, October 21, at 14:00 UTC to address two vulnerabilities each rated 9.2 under CVSS v4.0. The notice, reported by BleepingComputer on October 20, 2026, came after information about the flaws reportedly leaked ahead of a scheduled disclosure.
PHP said it reserved the right to release earlier if details of either vulnerability became public or evidence of active exploitation appeared. At the time of the advisory, the developers had not disclosed technical details, including which PHP versions are affected, how the flaws can be exploited, or which releases would carry fixes. They said full technical details, affected versions and fixed releases would be published with the updates.
Security researchers at watchTowr told BleepingComputer the flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are remote code execution issues. WatchTowr CEO Benjamin Harris said the company believed they affect PHP versions 5, 6, 7 and 8, and that it believed it had reproduced one of them, without releasing technical information before patches. WatchTowr said it had not observed exploitation in the wild.
Accounts differ on severity. WatchTowr and a since-deleted Hacker News post described both flaws as CVSS 10.0, while PHP assigned 9.2. WatchTowr also cited an originally planned Thursday disclosure, while PHP scheduled its release for the following morning.
For defenders, the practical step is to watch for the official PHP release and advisory, then confirm which versions are affected and fixed before upgrading. PHP powers many content management systems, e-commerce platforms and custom web services, so teams that run it should know where it sits in their estate and who owns patching. Until the vendor publishes details, treat third-party severity claims and version ranges as unconfirmed.
CVE references
Sources
- PHP warns admins of two critical flaws, emergency patches coming tomorrowPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning