PHP teams rush emergency patches after two critical RCE flaws leak early

The PHP security team is warning administrators to prepare for emergency security updates to address two critical vulnerabilities after information about the flaws reportedly leaked ahead of their scheduled disclosure. The team announced plans to release the updates on Wednesday, October 21, at 14:00 UTC, urging admins to be ready to install them as soon as they become available.

According to an advisory published on Tuesday, the PHP development team intends to publish the security updates on Wednesday morning Eastern Time. The two flaws are each rated 9.2 under CVSS v4.0. The team notified its ANNOUNCE mailing list, urging system administrators to prepare to install the security updates immediately upon release.

Context and Background

The PHP developers stated they reserve the right to release patches earlier if vulnerability details become public or if evidence of active exploitation emerges. Originally, the vulnerabilities were scheduled for disclosure on Thursday at 11:00 AM Eastern Time. The PHP security team warned that they might release the updates before the planned date should details leak or exploitation appear.

Security researchers at watchTowr confirmed to BleepingComputer that the leaked information is accurate. The firm’s CEO, Benjamin Harris, stated that the vulnerabilities are real and were previously scheduled under embargo. He noted that the researchers have successfully reproduced one of the flaws, tracked as CVE-2026-109618, but are withholding technical details until patches are available.

Who Is Affected

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are believed to affect PHP versions 5, 6, 7, and 8. According to watchTowr, both flaws allow for remote code execution. The PHP team has not yet disclosed which specific sub-versions are impacted or how the flaws can be triggered, leaving technical details undisclosed.

PHP powers a vast portion of the web, including many content management systems, e-commerce platforms, and custom web services. Because the affected versions span several major releases, a wide range of websites could be at risk. However, watchTowr clarified that they have not observed any active exploitation of these vulnerabilities in the wild despite the premature leak of information.

What should you do?

Administrators should monitor the PHP official announcements and mailing lists for the exact release time of the patches on Wednesday. Since no technical details are public, it is impossible to detect exploitation via logs or traffic analysis. Users should ensure their update mechanisms are functioning correctly to apply the patches as soon as they are distributed by the vendor.

What to do and how to stay safe: PHP

• Monitor official PHP security advisories for the exact release time of the emergency patches.
• Ensure your servers can automatically receive and install updates to minimize the exposure window.
• Audit your environment to confirm which PHP versions are currently in use across all services.
• Prepare to restart web services immediately after applying the patches to ensure the fixes are active.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When will the PHP security patches be released?

The PHP team plans to release the updates on Wednesday, October 21, at 14:00 UTC.

Which PHP versions are affected by these vulnerabilities?

Researchers believe the flaws affect PHP versions 5, 6, 7, and 8.

Are these vulnerabilities currently being exploited in the wild?

No, researchers state they have not observed active exploitation despite the leak.