PHP schedules patches for two critical vulnerabilities

PHP’s security team plans to release emergency updates on Wednesday, October 21, at 14:00 UTC (10:00 a.m. Eastern), to fix two vulnerabilities. The team rated each flaw 9.2 under CVSS v4.0 and urged administrators to install the updates as soon as they are available.

The team has not yet disclosed which PHP versions are affected, how the flaws can be exploited, or which releases will include fixes. It says it may release updates earlier if details become public or evidence of active exploitation emerges.

Security researchers at watchTowr told BleepingComputer that the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution vulnerabilities believed to affect PHP versions 5, 6, 7, and 8. watchTowr said it believes it reproduced CVE-2026-109618, but is withholding technical details until patches are available. The researchers said they had not observed exploitation in the wild.

Those claims differ from PHP’s official announcement. watchTowr described both flaws as CVSS 10, and said disclosure had originally been planned for Thursday at 11 a.m. ET. A now-deleted Hacker News post also claimed the flaws scored 10.0 and would be disclosed on October 22. PHP’s team assigned each a CVSS v4.0 score of 9.2 and scheduled the updates for October 21. It says it will publish technical details, affected versions, and fixed releases when the updates become available.