PHP Schedules Two Critical Security Patches for October 21

Administrators responsible for websites and web applications face an urgent security update as the PHP development team prepares two critical patches scheduled for October 21, 2026. The releases are planned for 14:00 UTC to address vulnerabilities rated 9.2 out of 10, while security researchers warn that exposed systems could face widespread attacks.

According to the PHP security advisory, the team may release the fixes earlier if technical details become public or evidence of active exploitation emerges. The maintainers have urged users to prepare their systems for immediate upgrades once the patches become available.

The vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619. Security firm watchTowr said it had confirmed that the flaws were real, although the full technical details and affected PHP versions had not yet been officially disclosed.

A circulating report described an exploit tool called PHP2Shell and included a video allegedly demonstrating code execution on servers running several PHP-based applications. These included WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. The claims had not been independently confirmed in the original report.

WatchTowr said the reported vulnerabilities could affect every PHP version dating back to PHP 5, which was released in 2004. However, the PHP security team had not yet published an official list of affected releases.

Researchers at security firm Sansec warned that attackers could move quickly after the patches become available.

“We expect mass attacks to start within 15 minutes of the release,” Sansec researchers said.

The warning highlights the importance of preparing systems before the technical details become public. Webfence and Huntress have also issued security guidance concerning the upcoming release.

Administrators have been advised to identify the personnel responsible for PHP maintenance, inventory applications that depend on the language, and schedule a maintenance window beginning at 14:00 UTC. Organizations should also prepare contingency plans in case the patches arrive earlier than expected.

Additional precautions include backing up website and database files, monitoring the official PHP website for announcements, and considering the temporary disconnection of nonessential systems until security updates can be installed.

PHP remains a foundational technology for websites, content management systems, and internal business applications. According to one security researcher cited by Ars Technica, approximately 1.3 million internet-connected hosts could be affected by the vulnerabilities.

The Laravel team separately announced that Laravel Forge and Laravel Cloud were preparing updates to address the PHP vulnerabilities and a second security issue involving Node.js. The team said it was coordinating with the PHP Foundation and tracking the Node.js release to deliver patched base images as quickly as possible.

The Laravel team noted that some applications might need to be redeployed to use the updated images, although it was also exploring a way to apply patches without requiring redeployment. The affected versions, corrected releases, and complete technical details were expected to be published alongside the security updates on October 21.