PHP security team alerts administrators to two critical 9.2 CVSS vulnerabilities, patches slated for Oct. 21

The PHP security team has warned that two remote-code-execution vulnerabilities, each rated 9.2 on the CVSS v4.0 scale, will be addressed in an emergency release on Wednesday, Oct. 21, 2026 at 14:00 UTC. The notice, posted on Oct. 20, said full technical details, affected versions and the patches will be published alongside the update, and that the team could issue the fixes earlier if the flaws become public or evidence of active exploitation emerges.

The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619. Security firm watchTowr described them as remote-code-execution bugs that could let attackers execute arbitrary code on vulnerable servers, while CERT-EU’s advisory echoed the same risk assessment. Both organisations cautioned that the PHP announcement does not disclose the CVE numbers or the exact mechanics of the flaws.

"Cloudflare says it is seeing early attempts to exploit two critical PHP vulnerabilities whose details surfaced before the PHP security team’s planned release," a Cloudflare spokesperson told reporters.

Preliminary reports suggest the issues may affect PHP versions dating back to PHP 5, though the vendor has not confirmed the scope. PHP has not indicated whether default installations are vulnerable or which configuration settings might mitigate the risk.

Administrators are advised to use the short preparation window to identify all PHP deployments, verify ownership, and plan the patch rollout. CERT-EU recommends isolating internet-facing PHP applications from public networks when immediate patching is not feasible, while balancing service availability and business requirements.

The notice also referenced a public proof-of-concept repository that provides verification tools and a lab setup for testing the flaws, known internally as “php2shell.” Past incidents, such as the rapid exploitation of CVE-2024-4577, underscore the importance of swift patch deployment, though no exploitation of the newly disclosed vulnerabilities has been confirmed.

Once the patches are released, operators should consult the official affected-version list, apply the appropriate updates, and confirm the running PHP version to ensure the fix is in place.