PHP team schedules emergency patches for two critical remote code execution flaws
The PHP development team will release emergency security updates on October 21 to fix two high-severity remote code execution vulnerabilities after details were leaked ahead of the planned disclosure.
The PHP security team announced that emergency updates will be issued on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern) to address two critical remote code execution flaws, each rated 9.2 under CVSS v4.0. Administrators were urged to prepare to install the patches as soon as they become available, and the team warned it could release updates earlier if the vulnerabilities are publicly disclosed or evidence of active exploitation emerges.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are believed to affect PHP versions 5 through 8. WatchTowr security researcher Benjamin Harris confirmed the flaws are real and noted that the information about them had been leaked before the originally scheduled disclosure date.
"We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the PHP security team said.
"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," Harris told BleepingComputer.
The PHP team has not disclosed technical details, affected versions, or the specific patches until the updates are released. WatchTowr reported that it has reproduced one of the flaws but will withhold further information until the official fixes are available.