Key points
- PHP releases patches for branches 8.2 through 8.5 only.
- Two flaws are rated 9.2 on the CVSS v4.0 scale.
- No evidence of wild exploitation has been confirmed yet.
PHP is releasing an emergency security update on October 21, 2026, at 14:00 UTC. The patch addresses two vulnerabilities that the PHP security team rates at 9.2 on the CVSS v4.0 scale. This release applies only to the four currently supported PHP branches: 8.2, 8.3, 8.4, and 8.5. Systems running older versions will not receive a fix from the vendor.
In plain English
Security researchers at watchTowr report that these two flaws allow remote code execution. They have tentatively assigned the identifiers CVE-2026-109618 and CVE-2026-109619 to the issues. However, PHP has not officially confirmed these CVEs or linked them to the 9.2 scores in its advisory. The vendor states that full technical details will be included with the software release.
The background
An online leak on October 20 claimed the flaws affected all versions from PHP 5 onward and gave them a score of 10.0. WatchTowr confirmed the existence of the flaws but noted that the scope and scores were unverified. PHP moved its planned release date forward to October 21, ahead of the rumored disclosure date, to mitigate risk before details became public.
What changes now
Administrators must apply the October 21 update to any server running PHP 8.2, 8.3, 8.4, or 8.5. PHP does not provide security updates for versions 8.1, 8.0, 7.x, or 5.x, as these are end of life. As of October 21, watchTowr reported no known exploitation in the wild, though this does not rule out active attacks.
Who needs to act first
Teams should prioritize updating internet-facing web servers that run supported PHP versions. Before applying the patch, create a backup of the current configuration and database to ensure a quick recovery if the update causes compatibility issues. Test the update in a staging environment first to verify that applications function correctly. If immediate patching is not possible, restrict access to sensitive endpoints and monitor logs for unusual activity.
What to do and how to stay safe: PHP
- Verify which PHP version your web server is currently running by checking the software version string.
- Apply the October 21 security update to all systems running PHP 8.2, 8.3, 8.4, or 8.5.
- Plan to migrate any servers running end-of-life PHP versions to a supported branch as soon as possible.
- Monitor server logs for signs of unauthorized code execution or unusual outbound connections.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected?
PHP is only patching versions 8.2, 8.3, 8.4, and 8.5. Older versions are end of life and will not receive a fix.
Are these flaws being exploited in the wild?
WatchTowr reported no known exploitation as of October 21, but this does not confirm that attacks are not occurring.
What are the CVE identifiers for these flaws?
Researchers are using CVE-2026-109618 and CVE-2026-109619, but PHP has not officially confirmed these identifiers yet.
