What happened. On Tuesday, Oct 20, php.net posted an advance notice titled “Upcoming Critical PHP Security Release.” It says the release is scheduled for Wednesday, Oct 21 at 14:00 UTC, fixes two critical vulnerabilities both rated CVSS v4.0 9.2, and that “All PHP users are encouraged to prepare now.” The team added that it reserves the right to release earlier “should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” The same notice went to the PHP ANNOUNCE mailing list.
Why the rush. watchTowr CEO Benjamin Harris told BleepingComputer that two PHP remote code execution vulnerabilities “have been leaked” after being scheduled under embargo for Thursday at 11 AM ET. watchTowr tracks them as CVE-2026-109618 and CVE-2026-109619, says “we can confirm that these vulnerabilities are indeed real,” and believes it has reproduced CVE-2026-109618. A now-deleted Hacker News post had already named the same two CVE IDs.
What isn’t confirmed yet. PHP hasn’t said which branches are affected, how the bugs are reached, or which releases fix them; that comes with the release. watchTowr describes both as CVSS 10 and says they’re understood to affect PHP 5, 6, 7 and 8, while PHP’s own score is 9.2 under CVSS v4.0. watchTowr says it hasn’t seen exploitation in the wild. Technical details: Undisclosed until the patch ships.
Why a security team should care. PHP sits under WordPress, Drupal, Magento, Laravel apps and a long tail of internal tools, and a lot of it runs on end-of-life branches that will never get an upstream fix. A leaked RCE with a release window measured in hours is the classic setup for scanning the moment a diff lands: attackers read the patch, and anything internet-facing that hasn’t updated is next. The PHP 5 claim matters most for buyers with old line-of-business apps and vendor appliances that bundle their own PHP runtime.
What we’d do tonight. Inventory every PHP runtime, including the ones inside containers, hosting panels and vendor appliances, and note the exact version and who owns the patch. Line up a change window for Wednesday morning Pacific and pre-stage package updates from your distro or image pipeline. Flag EOL PHP hosts now, since they likely need a WAF rule, isolation or a vendor answer rather than a patch. Ask hosting and SaaS providers that run PHP for you when they’ll apply it. And watch php.net and the ANNOUNCE list overnight, since the team says it may ship early.