Key points
- Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the CVSS scale.
- Patches are scheduled for release on Wednesday, October 21, at 14:00 UTC, but could arrive earlier.
- The flaws affect PHP versions 5, 6, 7, and 8, impacting many popular web applications.
Two critical security flaws in PHP require immediate attention from website administrators. The PHP security team announced that emergency updates will be released on Wednesday, October 21, at 14:00 UTC, according to an advisory published Tuesday. These updates address two vulnerabilities, each carrying a CVSS v4.0 severity rating of 9.2. The team warned that they may release the patches earlier if evidence of active exploitation appears.
In plain English
These vulnerabilities allow attackers to run code remotely on servers using PHP. This means an attacker could take control of a website or application without needing to log in first. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Security researchers at watchTowr confirmed that both vulnerabilities are real and affect PHP versions 5, 6, 7, and 8. Although details leaked before the scheduled disclosure, no active exploitation has been observed yet.
The background
PHP powers a significant portion of the web, including content management systems and e-commerce platforms. An unconfirmed report included a video of an exploit tool called PHP2Shell executing code on servers running various applications. Those applications included WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. Researchers from Sansec expect mass attacks to begin shortly after the patches are released.
What changes now
Administrators must prepare to install these updates as soon as they become available. The PHP team sent a notice to its ANNOUNCE mailing list urging users to get ready. While the developers have not disclosed technical details about how the flaws are exploited, the high severity ratings indicate significant risk. Users should monitor the PHP.net homepage for any announcements regarding an earlier release time or changes to the schedule.
Who needs to act first
Teams should prioritize systems that are directly exposed to the internet, such as public-facing websites and customer portals. Internal tools and development environments can wait until those critical systems are secured. Before applying any updates, ensure you have complete backups of both site files and databases. Test the patch in a staging environment first to verify that it does not break existing functionality. Roll out the fix in small batches to monitor for unexpected issues.
What to do and how to stay safe: PHP
- Identify all servers and applications running PHP versions 5 through 8 within your infrastructure.
- Create full backups of your website files and databases before attempting any updates.
- Monitor official PHP channels for the exact release time of the emergency patches.
- Isolate non-essential systems from the internet until they can be patched safely.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by these vulnerabilities?
According to watchTowr, the flaws affect PHP versions 5, 6, 7, and 8.
When will the patches be released?
The PHP team plans to release updates on Wednesday, October 21, at 14:00 UTC, but may release them earlier.
Are these vulnerabilities being exploited right now?
Researchers have not observed active exploitation in the wild, despite the early leak of information.
