Administrators running PHP-based systems need to brace for urgent security updates following the premature disclosure of two critical vulnerabilities. The PHP development team moved up its patch release schedule and announced that fixes will arrive on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), rather than the originally planned Thursday date.

PHP underpins a vast portion of the web infrastructure, supporting content management systems, e-commerce platforms, and numerous custom web applications. The two flaws carry a CVSS v4.0 severity rating of 9.2 each and have been identified as CVE-2026-109618 and CVE-2026-109619.

The PHP security team issued a statement to its ANNOUNCE mailing list cautioning administrators to stand ready for rapid deployment of the incoming patches. The team also indicated it may release fixes even sooner if additional details become public or active attacks emerge.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild

PHP security team

The PHP team has withheld specifics about the vulnerabilities, including which versions face risk, exploitation mechanics, and which releases will receive patches. That information will be published alongside the security updates.

Details Emerge From Security Researchers

Security researchers at watchTowr confirmed to BleepingComputer that the flaws are remote code execution vulnerabilities affecting PHP versions 5, 6, 7, and 8. The firm's CEO Benjamin Harris stated that the vulnerabilities were originally scheduled for embargo release on Thursday at 11 AM Eastern.

In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET

Benjamin Harris, watchTowr CEO

watchTowr indicated it has successfully reproduced CVE-2026-109618 but is withholding technical details pending patch availability. The researchers emphasized they have not detected any active exploitation attempts despite the leak.

While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8.

Benjamin Harris, watchTowr CEO

How the Leak Unfolded

A user posting under the handle "petecooper" on Y Combinator's Hacker News forum disclosed information about the two critical PHP remote code execution flaws, claiming they would be revealed on October 22. The post, which has since been removed, identified the vulnerabilities by their CVE numbers and stated both carried CVSS scores of 10.0 affecting PHP versions back to version 5.

watchTowr subsequently posted a warning on X noting that embargoed zero-day remote code execution vulnerabilities in PHP had surfaced prematurely.

We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real

watchTowr researchers

Discrepancies in Severity Ratings

A notable inconsistency exists between the official PHP announcement and the leaked information. The PHP security team assigned each vulnerability a CVSS v4.0 score of 9.2, whereas both watchTowr and the Hacker News post referenced CVSS 10.0 ratings. Additionally, the leaked information pointed to a Thursday disclosure window, conflicting with PHP's official Wednesday morning release schedule.