The PHP security team said on Tuesday that it will ship a security release on Wednesday, October 21, to fix two critical vulnerabilities, after information about the embargoed flaws, tracked as CVE-2026-109618 and CVE-2026-109619, leaked online.
In an advance notice on php.net, the team said the release is scheduled for 14:00 UTC, which is 10:00 a.m. ET and 19:30 IST. It rated both vulnerabilities 9.2 under CVSS v4.0 and urged all PHP users to prepare now so they can upgrade as soon as the builds are available. The PHP Foundation shared the same notice on X.
The PHP team said full details, affected versions, and fixed versions will be published with the release. It also said it may ship earlier if details of either flaw become public or if evidence of active exploitation emerges.
Wednesday is a day earlier than the date researchers under embargo had been working to. Security firm watchTowr said everyone had been supposed to wait until Thursday at 11:00 a.m. ET, and the first public report of the leak pointed to October 22.
That report came in a “Tell HN” post on Hacker News at 15:20 UTC on October 20. Citing a “reliable source”, user petecooper wrote that two PHP remote code execution flaws rated CVSS 10.0 were due for disclosure, affecting all PHP versions from PHP 5 onwards. The poster admitted having no evidence, and the post was later flagged, but screenshots were already circulating on X and Mastodon.
watchTowr then confirmed the leak, saying the information concerned zero-day RCE vulnerabilities in PHP. “We can confirm that they’re real,” the company said, adding that it could not share more and urging administrators to patch once fixes are out.
Security researcher Florian Roth wrote on X that the flaw is an RCE in PHP core and that only PHP 8 will receive patches. PHP 5 and PHP 7 reached end of life years ago, so servers still running them would stay exposed without an official fix. Nicolas Krassas said he will publish a hands-on lab once the embargo lifts, and Kevin Beaumont flagged the leak on Mastodon.
The official severity differs from the leak. PHP rates both bugs 9.2 under CVSS v4.0, while the leaked posts cited 10.0 and did not say which version of the scoring system they used. The PHP notice does not name the CVE IDs or describe the bugs as code execution flaws; those details come from watchTowr and the leaked reports.
No technical details have been made public. Both CVE-2026-109618 and CVE-2026-109619 remain in reserved status, and none of the posts identify the affected function, extension, or configuration. In an FAQ on the flaws, watchTowr said it had seen no exploitation in the wild, that the bugs are not in CISA’s Known Exploited Vulnerabilities catalog, and no workaround exists before the patch.
An embargo is a private window during which a vendor coordinates fixes with Linux distributions, hosting providers, and security firms, so that patched builds ship at the same moment as the advisory. Once the severity and date leaked, anyone already holding the bugs knew how long they had before fixes landed.
PHP powers WordPress, Drupal, Magento, and most shared hosting, and many site owners rely on their hosting provider to deploy new PHP builds. Administrators can check which PHP version each server runs before 14:00 UTC, line up the upgrade, and plan to move anything still on PHP 5 or 7 to a supported PHP 8 branch. The most recent PHP security releases, 8.5.11, 8.4.26, 8.3.35, and 8.2.34, shipped on September 24.
PHP powers WordPress, Drupal, Magento, and most shared hosting, so a core flaw that can be exploited remotely without authentication reaches a very large share of the web. Many site owners depend on their hosting provider to roll out new PHP builds. Administrators can check which PHP version each server runs now, plan to move anything still on PHP 5 or 7 to a supported PHP 8 branch, and be ready to patch on Thursday.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
