PHP Schedules Critical Security Patches for October 21

Administrators running PHP-powered websites face an urgent security update as the PHP development team prepares fixes for two critical vulnerabilities following an early disclosure of information about the flaws. The release is scheduled for Wednesday, October 21, 2026, at 14:00 UTC, or 10:00 a.m. Eastern, with the developers urging users to install the updates as soon as they become available.

In an advance security notice published October 20, the PHP team assigned both vulnerabilities scores of 9.2 under CVSS v4.0. The identifiers CVE-2026-109618 and CVE-2026-109619 were disclosed by security researchers at watchTowr, who described the issues as remote code execution (RCE) flaws.

The official PHP announcement has not yet identified the affected software versions, explained the technical causes, or listed the releases containing fixes. Those details are expected to accompany the security updates.

The PHP security team warned that it could accelerate the release if the situation changes.

"We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the PHP security team said.

The team also encouraged administrators to prepare their systems before the patches arrive, emphasizing the need for a prompt upgrade once corrected builds are published.

Security company watchTowr confirmed that information about the vulnerabilities had circulated before the planned disclosure window. Its CEO, Benjamin Harris, said the researchers were withholding technical details while the flaws remained unpatched.

"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," Harris said.

In a separate statement, Harris described the vulnerabilities as confirmed issues and said the researchers believed they affected multiple generations of PHP. However, watchTowr's reported severity assessment differs from the official PHP ratings.

"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8," Harris said.

watchTowr also reported that it had reproduced CVE-2026-109618 but would not publish technical findings before patches became available. The company said it had not observed exploitation of the vulnerabilities in real-world attacks.

The disclosure followed a post on Hacker News that was subsequently deleted or flagged. The post, published October 20, claimed that two PHP RCE vulnerabilities would be disclosed October 22 and assigned scores of 10.0, while acknowledging that the author had no direct evidence.

watchTowr subsequently addressed the premature disclosure on X, stating that the vulnerabilities were genuine and reiterating the need for administrators to apply fixes when released.

"We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real," the researchers said.

The differing severity scores reflect an important distinction: PHP's official notice specifies CVSS v4.0, while the leaked reports cited scores of 10.0 without establishing which scoring version they used. The PHP team has not independently confirmed the leaked reports' technical descriptions.

PHP underpins widely used content management systems and web applications, including WordPress, Drupal, and Magento. Its widespread use across websites and shared hosting environments means that vulnerable installations could affect a broad range of online services.

Administrators should identify the PHP versions running on their servers and coordinate upgrades with hosting providers where necessary. PHP 5 and PHP 7 have reached end of life, according to the source reports, and administrators using those releases face additional challenges because they no longer receive routine security maintenance.

The PHP team is expected to publish the affected versions, fixed releases, and technical details when the security updates become available on October 21 at 14:00 UTC. No workaround had been identified in the researchers' preliminary information.