PHP warns admins of two critical flaws, emergency patches coming tomorrow

Key Points:

• The PHP security team plans to release emergency security updates on October 21 at 14:00 UTC to address two critical remote code execution vulnerabilities rated 9.2 under CVSS v4.0, following a leak of information ahead of the scheduled disclosure.
• The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, reportedly affect PHP versions 5 through 8 and have been confirmed by security researchers at watchTowr, who have reproduced one flaw but are withholding technical details until patches are released.
• Despite the leak, there is no evidence yet of active exploitation in the wild, but PHP administrators are urged to prepare to install updates promptly once available to mitigate potential risks.
• Conflicting information exists regarding the severity and disclosure timing, with watchTowr and a now-deleted Hacker News post claiming CVSS scores of 10.0 and a later disclosure date, while the PHP team officially rates the flaws at 9.2 and has moved up the release to October 21.
• The PHP development team has not disclosed technical specifics or affected versions publicly but will provide full details alongside the security updates to ensure administrators can adequately protect their systems.