PHP warns of two critical flaws, emergency patches due October 21

The PHP security team has warned administrators to prepare for emergency updates addressing two critical vulnerabilities, with fixes scheduled for Wednesday, October 21, 2026, at 14:00 UTC, according to BleepingComputer. Because PHP powers a large share of the world's web servers, the advance warning gives organizations a short window to line up maintenance before technical details become public.

What happened

According to BleepingComputer, PHP published an advisory on Tuesday, October 20, and sent a notice to its ANNOUNCE mailing list urging administrators to install the updates as soon as they become available. The project rated both flaws 9.2 under CVSS v4.0 and said it reserves the right to release the fixes earlier if details become public or if active exploitation is observed.

PHP itself has not yet disclosed the affected versions, the nature of the bugs or the fixed releases. Those details are expected to be published together with the updates.

What is known about the flaws

BleepingComputer reports that, according to security firm watchTowr and a since-deleted Hacker News post, the vulnerabilities are remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. watchTowr says they are believed to affect PHP 5, 6, 7 and 8, while the Hacker News post said the flaws date back to PHP 5.

There are discrepancies between the accounts. watchTowr and the deleted post described both flaws as CVSS 10.0, whereas PHP scored them 9.2. watchTowr also said the embargo had been set for Thursday at 11 a.m. ET, and the Hacker News post cited an October 22 disclosure, while PHP scheduled its release for Wednesday. These differences have not been resolved publicly.

watchTowr CEO Benjamin Harris told BleepingComputer that details had leaked within the previous hour and confirmed that the vulnerabilities are real. The firm says it has reproduced CVE-2026-109618 but will not publish technical details until patches are available. watchTowr has not observed exploitation in the wild, according to the report.

Who is affected

Until PHP publishes its advisory, the exact list of affected branches is unconfirmed. If watchTowr's assessment is accurate, the flaws could reach back across multiple major versions, including releases that no longer receive official support. Hosting providers, organizations running PHP-based content management systems and teams maintaining older PHP deployments should treat the upcoming release as a priority.

What to do

• Plan an emergency maintenance window for October 21 and be ready to deploy the new PHP releases as soon as they are published.
• Inventory all systems running PHP, including containers, appliances and legacy servers, so updates can be rolled out quickly.
• Check whether your Linux distribution or hosting provider will ship backported packages, and track their advisories alongside the PHP release.
• Identify deployments on end-of-life PHP versions, which may not receive fixes, and plan isolation or upgrades.
• Review PHP's full advisory once it is released for affected versions and any interim mitigations.