PHP Team Announces Fix for Two Critical 9.2 CVSS Vulnerabilities

The PHP security team announced on October 20, 2026, that an upcoming software release will resolve two critical vulnerabilities. Each flaw carries a Common Vulnerability Scoring System version 4.0 score of 9.2, indicating severe risk. Administrators are advised to prepare for immediate upgrades as soon as the update becomes available.

The maintainers stated they may release the patches earlier than scheduled if vulnerability details leak publicly or if evidence of active exploitation appears. The security update, planned for Wednesday, October 21, 2026, at 14:00 UTC, will include full technical details, affected versions, and fixed releases.

Conflicting Reports and Unverified Claims

WatchTowr reported two potential remote code execution vulnerabilities, assigning them the identifiers CVE-2026-109618 and CVE-2026-109619. According to GBHackers, the PHP team has not yet confirmed these specific identifiers or the technical nature of the flaws. WatchTowr’s FAQ suggests the issues could allow attackers to run arbitrary code on affected servers, but emphasizes that these details stem from unverified reports.

There is a discrepancy in the reported timelines. WatchTowr referenced a rumored announcement for October 22 at 18:00 CEST based on social media chatter. In contrast, the PHP official notice specifies October 21 at 14:00 UTC. Security teams should rely on the vendor’s published schedule rather than third-party rumors when coordinating response activities.

Uncertain Scope and Impact

WatchTowr’s reporting suggests the vulnerabilities could affect every PHP version from PHP 5 onward. However, PHP maintainers have not verified this claim, and no specific affected components or vulnerable functions have been disclosed. Consequently, administrators cannot determine if their specific deployment models or application features expose systems to the reported flaws.

The official notice does not explicitly link the two 9.2 scores to the named CVEs. While both announcements concern two PHP vulnerabilities, it is premature to conclusively associate the scores with CVE-2026-109618 and CVE-2026-109619. WatchTowr’s table lists the identifiers but does not assign scores due to the limited information available before the planned release.

What should you do?

Security teams should monitor the official PHP security announcements for the release of patches on October 21. Until the vendor confirms which components are affected, organizations should review their PHP version inventory to identify systems running legacy versions. Administrators should prepare upgrade paths for their production environments to minimize downtime once the fix is available.

What to do and how to stay safe: PHP

• Monitor official PHP security channels for the release of patches on October 21, 2026.
• Inventory all servers running PHP to identify versions that may be affected by the update.
• Prepare automated upgrade procedures to apply patches quickly once they become available.
• Review firewall rules to restrict unnecessary external access to PHP-enabled endpoints.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for the reported PHP vulnerabilities?

The vulnerabilities are rated 9.2 under CVSS v4.0.

When will the PHP security update be released?

The update is scheduled for October 21, 2026, at 14:00 UTC, though it may be released earlier if exploitation is detected.

Are CVE-2026-109618 and CVE-2026-109619 confirmed by the PHP team?

No, the PHP team has not yet confirmed these identifiers or the technical details of the vulnerabilities.