PHP Team Addresses Leaked Critical Vulnerabilities Ahead of Scheduled Patches
The PHP security team confirmed work on patches for two leaked flaws after early disclosure of CVE IDs and exploit details online.
Key points
- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were leaked before patches were available.
- The PHP team rated the flaws at CVSS 9.2, lower than the leaked claim of 10.0.
- CERT-EU and the PHP team urged users to prepare for immediate remediation upon patch release.
The PHP security team confirmed it is working on patches for two critical vulnerabilities after details were leaked online ahead of the scheduled disclosure date. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, were originally planned for public release on October 21 at 2pm GMT.
A user named ‘petecooper’ posted information about the vulnerabilities on the Hacker News forum on October 20. The post, which has since been deleted, revealed the CVE identifiers and claimed the flaws allowed remote code execution. It also incorrectly stated the disclosure would occur on October 22.
Context and Background
WatchTowr confirmed that the two CVEs were indeed scheduled for later disclosure alongside security patches. The early leak included claims that the vulnerabilities affected PHP versions dating back to PHP 5. The leaker asserted that exploiting these flaws could lead to server takeover and remote code execution.
The PHP security team published a security bulletin on October 21 to address the premature disclosure. They confirmed that patches were scheduled for release at 2pm GMT on October 21. The team noted they reserve the right to release updates earlier if evidence of active exploitation appears in the wild.
Who Is Affected
PHP is used by approximately 69.7% of websites with known server-side programming languages, according to W3Techs data. This includes major content management systems such as WordPress, Drupal, Joomla, and Magento. E-commerce platforms and various web services also rely on PHP, making the potential impact widespread.
The PHP team allocated a critical severity rating of CVSS 9.2 to the vulnerabilities. This is lower than the maximum severity score of 10.0 suggested by the individual who shared the leak. CERT-EU urged PHP users to prepare for patching following the premature disclosure of the vulnerability details.
What should you do?
Organizations relying on PHP should monitor official channels for the release of security patches. The PHP team indicated that patches were scheduled for October 21. Users should be prepared to apply updates as soon as they are available to mitigate the risk of remote code execution.
What to do and how to stay safe: PHP
- Monitor official PHP security advisories for the release of patches for CVE-2026-109618 and CVE-2026-109619.
- Prepare your systems to apply updates immediately once the vendor provides them, as exploitation may begin before patches are widely deployed.
- Review server logs for signs of unauthorized access or unusual activity, particularly on systems running older versions of PHP.
- Ensure that your inventory of PHP-based applications, such as WordPress or Drupal, is up to date and ready for rapid patching.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the leaked PHP vulnerabilities?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
When were the patches scheduled to be released?
The PHP security team scheduled the release of patches for October 21 at 2pm GMT.
How severe are these vulnerabilities according to the PHP team?
The PHP team rated the vulnerabilities at a critical severity of CVSS 9.2.
