PHP maintainers schedule emergency patches for two critical vulnerabilities

The PHP project announced that patches for two vulnerabilities rated 9.2 out of 10 will be released in just over 12 hours. The advisory urges all PHP users to ready their systems for immediate upgrade and notes that an earlier release may occur if details become public or active exploitation is observed.

"All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," the advisory said.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are reported to affect every PHP version from PHP 5 onward. Security firms watchTowr, Sansec and Webfence have confirmed the flaws and warned that widespread attacks could begin shortly after the patches are available.

Administrators are advised to identify responsible personnel, inventory all PHP-based applications, schedule a maintenance window starting at 14:00 UTC, back up site and database files, and monitor the PHP.net homepage for any updates. Some experts recommend disconnecting non-essential systems until the patches are applied.

An estimated 1.3 million Internet-connected hosts could be impacted, underscoring the potential for significant disruption if the vulnerabilities are exploited before remediation.