Emergency PHP advisory warns of two critical RCE flaws
PHP's security team posted an urgent notice on Wednesday, Oct 21 2026 at 14:00 UTC, flagging two remote‑code‑execution vulnerabilities that each carry a CVSS v4.0 rating of 9.2.
What we know
The flaws are catalogued as CVE‑2026‑109618 and CVE‑2026‑109619. The team emailed the ANNOUNCE mailing list, urging administrators to stand by for emergency patches that will be released later that day.
Why it matters
Both CVEs sit in the core PHP interpreter, the language that powers a huge share of web sites and APIs. A successful exploit could let an attacker run arbitrary code on any server that processes malicious PHP payloads.
Technical clues
Official details are still under wraps. A deleted Hacker News post hinted at a planned disclosure on Oct 22, but the post vanished before anyone could verify it.
Unconfirmed reports: security researcher “watchTowr” has claimed the vulnerabilities affect PHP 5 through PHP 8 and that they managed to reproduce CVE‑2026‑109618 in a lab. The researcher also posted a CVSS 10.0 score, which conflicts with the official 9.2 rating. No evidence of active exploitation has surfaced yet.
Who should be on alert
Any organization running PHP‑based applications should treat the advisory as high priority. This includes web‑hosting providers, SaaS platforms, and internal services that rely on PHP for dynamic content.
Immediate steps
- Verify you are subscribed to the PHP ANNOUNCE mailing list.
- Apply the emergency patches as soon as they are released – the advisory says they will be available later on Oct 21.
- If you cannot patch immediately, consider temporary mitigations such as disabling the vulnerable functions (e.g.,
eval(),system()) or moving critical workloads behind a web‑application firewall that can block suspicious payloads. - Monitor official PHP channels for any further technical advisories or proof‑of‑concept releases.
Stay tuned – the situation will evolve once the patches land and more details emerge.