errors.x7.al › Recent issues

PHP prepares emergency patches for two critical vulnerabilities

21 October 2026

The PHP security team has given administrators advance notice of an emergency security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC, addressing two critical vulnerabilities that are each rated 9.2 under CVSS v4.0. The notice, published on 20 October, followed reports that details of the flaws had leaked ahead of the planned disclosure. Full technical details, affected versions and fixed versions will be published only when the updates ship.

What's happening

In its advisory, the PHP development team says the release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC and covers two critical vulnerabilities, both rated CVSS v4.0 9.2. The team explicitly reserves the right to ship earlier "should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." Administrators are encouraged to prepare now. No technical details, affected version ranges or fixed release numbers have been disclosed yet.

Security firm watchTowr says the two flaws are real and tracks them as CVE-2026-109618 and CVE-2026-109619. According to watchTowr, both are remote code execution (RCE) vulnerabilities believed to affect PHP versions 5, 6, 7 and 8, and the firm says it believes it has reproduced CVE-2026-109618. watchTowr told BleepingComputer that it is withholding technical information until patches are available, and that it has not observed exploitation in the wild.

The notice appears to follow a leak. Ars Technica reports that a purported report showed a video of an exploit tool dubbed "PHP2Shell" executing code on servers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel, Symfony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9. Ars says it could not locate the original report, so the video and the list of affected applications should be treated as unconfirmed.

Some details do not line up. watchTowr described the flaws as CVSS 10.0 and referred to a disclosure originally planned for Thursday, 22 October at 11:00 ET, while PHP's advisory assigns 9.2 and schedules the release for Wednesday. Those discrepancies may reflect different scoring or changing plans; the PHP team's figures are the officially confirmed ones.

Who's affected

• Potentially any site running PHP. PHP underpins a large share of the web, including CMSes, e-commerce platforms and custom applications. The vendor has not yet named affected versions.
• PHP 5, 6, 7 and 8 are the branches watchTowr believes are affected. If accurate, that includes long-unsupported branches that no longer receive official fixes.
• Popular PHP applications such as WordPress, Drupal, Joomla, MediaWiki, Magento, Laravel and Symfony appear in the reportedly leaked demonstration. That is not confirmation they are vulnerable in every configuration.
• Server configuration is unknown. It is not yet clear whether exposure depends on the SAPI in use (PHP-FPM, mod_php, CGI), on specific extensions, or on php.ini settings.
• No confirmed attacks. As of the time of writing, watchTowr says it has not seen exploitation in the wild. PHP's warning about active exploitation is a contingency, not a report that it has occurred.

What to do

• Inventory your PHP versions now. List every host, container image and managed platform that runs PHP, the exact version, and how it is updated (package, repository, source build or base image).
• Prepare the upgrade path in advance. Confirm your package mirrors are reachable, that you have a tested rollback, and who can approve an out-of-hours deployment.
• Patch as soon as the fixed versions are published. The PHP team's advice is to upgrade as soon as the release is available. Watch the official announcement page and the php.net ANNOUNCE mailing list for the exact version numbers.
• Expect the schedule to move. PHP may release earlier if details become public. Convert 14:00 UTC to your local time and monitor.
• There is no confirmed workaround yet. With neither the vulnerability class nor the affected code paths published, no specific mitigation can be recommended; a web application firewall may reduce exposure but is no substitute for patching.
• Plan for unsupported branches. If you still run PHP 5, 6 or an end-of-life 7.x release, check whether a fix will exist at all; often the realistic option is to migrate.

Sources

• PHP.net — Upcoming Critical PHP Security Release — the vendor's official advance notice: two critical vulnerabilities rated CVSS v4.0 9.2, release scheduled for 21 October 2026 at 14:00 UTC.
• BleepingComputer — reports the warning to administrators and watchTowr's statement that CVE-2026-109618 and CVE-2026-109619 are real RCE flaws, with no exploitation observed so far.
• Ars Technica — describes the leaked "PHP2Shell" exploit video and the applications it reportedly targeted, while noting the original report could not be located.