Two Critical PHP Vulnerabilities: Security Release Due 21 October 2026, Prepare Now

The PHP security team has announced an upcoming security release that addresses two vulnerabilities, each of which PHP rates CVSS v4.0 9.2 (Critical). PHP has scheduled the release for Wednesday, 21 October 2026 at 14:00 UTC and says it may ship earlier if details of either flaw become public or if exploitation is seen in the wild. No patch is available yet. PHP has not yet published affected versions or fixed versions and says it will publish them with the release.

CERT-EU (Security Advisory 2026-018) and the researchers at watchTowr (speaking to BleepingComputer) identify the flaws as CVE-2026-109618 and CVE-2026-109619 and describe them as remote code execution (RCE) issues. PHP's own notice does not name CVE IDs, and at the time of writing neither ID has a public record in NVD or on cve.org. BleepingComputer and watchTowr report that details of the flaws leaked before the planned disclosure date. watchTowr told BleepingComputer it has not seen any exploitation in the wild.

PHP powers many websites and web applications, including content management systems, e-commerce platforms and custom web services (BleepingComputer). That means it is very likely to be somewhere in your vendors' stacks.

Technical Information

PHP has published no technical details. Neither have CERT-EU or watchTowr. This advisory does not cover how the flaws work.

What is known so far (times in UTC unless noted):

• 20 Oct 2026: The PHP security team posts an advance notice on php.net: one release, two critical vulnerabilities, both rated CVSS v4.0 9.2, scheduled for 21 October 2026 at 14:00 UTC. The notice says "Full details, affected versions, and the fixed versions will be published with the release." PHP also sends the notice to the php.announce mailing list (message #509, 19:33 UTC), and it is relayed to the oss-security list.
• 20 Oct 2026: BleepingComputer reports that information about the flaws reportedly leaked before the planned disclosure. watchTowr told the outlet the flaws "are indeed real" and RCE issues, tracked as CVE-2026-109618 and CVE-2026-109619. It said it believes it has reproduced CVE-2026-109618 and has not seen exploitation in the wild. PHP's official rating is CVSS v4.0 9.2, and this advisory uses PHP's figure.
• 20–21 Oct 2026: CERT-EU publishes Security Advisory 2026-018. It names both CVE IDs, describes potential unauthenticated RCE based on the CVSS scores, and advises organisations to prepare for immediate patching.
• 21 Oct 2026, 14:00 UTC (scheduled): PHP security release. It may come earlier.

CVE / KEV status (checked 21 Oct 2026, Asia/Nicosia): NVD returns no records for CVE-2026-109618 or CVE-2026-109619, and cve.org has no published record. Neither CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Affected Product Versions

• Official: PHP has not yet published the affected versions. It will do so with the release.
• Reported: CERT-EU says the vulnerabilities "could affect all PHP versions from PHP 5 onwards". watchTowr told BleepingComputer it understands the flaws affect PHP 5, 6, 7 and 8.
• Fixed versions: not yet published. At the time of writing, the newest builds listed on php.net are PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34. These are the current builds, not fixed versions. Treat any fixed version numbers that appear before PHP's release as unconfirmed.

Workaround and Mitigation

There is no patch yet and no vendor workaround. PHP's only instruction so far is to prepare to upgrade as soon as the release is available. Steps 1 to 4 below are Rescana's guidance for using the time before the release; step 5 is CERT-EU's.

1. Inventory PHP everywhere. Look beyond your web servers: include PHP runtimes bundled inside applications, container images, hosting control panels, and vendor appliances or virtual appliances that ship their own PHP. Record the version and who maintains each one.
2. Prioritise internet-facing applications. Rank PHP-based apps reachable from the internet above internal ones, starting with anything that handles customer data or authentication.
3. Stage and test the patch path. Prepare change windows, rollback plans and test environments now so you can deploy as soon as fixed builds land. If you rely on OS distributions, managed hosting or vendor appliances, find out how and when they will ship the fix.
4. Watch php.net for an early release. PHP says it may release ahead of 14:00 UTC. Monitor the php.net news page, the php.announce list and php.net downloads.
5. Plan compensating controls. Where you can't patch right away, CERT-EU advises organisations to "consider isolating internet-facing applications from public networks until a fix can be applied". Decide in advance which applications could be isolated or restricted, and who approves that. Apply any mitigations PHP publishes with the release.

Indicators of Compromise

None published. PHP, CERT-EU and watchTowr have released no indicators of compromise, and watchTowr reports no observed in-the-wild exploitation (via BleepingComputer).

Why this matters for vendor risk

A PHP fix only protects you once every vendor running PHP in its stack has deployed it, and many of those dependencies are invisible from the outside. The fastest way to close that gap is to ask your critical vendors now whether they run PHP, including bundled runtimes and appliances, and what their patch timeline is once the release ships. Then follow up until each one confirms.

What we will update: We will update this post when PHP publishes the security release, adding the official affected and fixed versions, CVE details, and any change in NVD or CISA KEV status.

Sources

• PHP News Archive 2026, "Upcoming Critical PHP Security Release" (20 Oct 2026): https://www.php.net/archive/2026.php#2026-10-20-1
• php.announce #509, "[ANNOUNCE] Upcoming Critical PHP Security Release": https://news-web.php.net/php.announce/509
• oss-security relay of the PHP notice (20 Oct 2026): https://www.openwall.com/lists/oss-security/2026/10/20/34
• CERT-EU Security Advisory 2026-018, "Critical Vulnerabilities in PHP": https://cert.europa.eu/publications/security-advisories/2026-018
• BleepingComputer, "PHP warns admins of two critical flaws, emergency patches coming tomorrow" (20 Oct 2026): https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
• PHP downloads (current builds; fixed versions will appear here): https://www.php.net/downloads.php
• Ars Technica, "PHP warns it plans to release 2 emergency patches imminently" (Dan Goodin, 21 Oct 2026): https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
• Sansec, "PHP2Shell" research post (21 Oct 2026): https://sansec.io/research/php2shell
• Huntress, "Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)" (21 Oct 2026): https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities

Forward this to your TPRM owner: If your vendors run PHP-based web apps, portals or appliances, now is the time to ask whether they're affected and when they will patch, before the release lands.

Want to see which of your vendors expose PHP-based services and how quickly they patch? Book a demo.