Key points
- PHP releases emergency patch on October 21, 2026, for two critical vulnerabilities.
- Only PHP versions 8.2 through 8.5 receive vendor-provided fixes for these flaws.
- Researchers report potential remote code execution, though exploitation remains unconfirmed.
PHP delivers an out-of-cycle security release on October 21, 2026, at 14:00 UTC to address two critical vulnerabilities. The PHP security team rates both flaws at 9.2 on the CVSS v4.0 scale. These issues allow for remote code execution, according to reports from watchTowr. The vendor has not yet disclosed specific technical details or attack vectors associated with these defects.
In plain English
Attackers could potentially run unauthorized code on servers running affected PHP versions. WatchTowr researchers identified these flaws as possible remote code execution risks. The PHP team announced the severity but withheld technical specifics until the patch release. Administrators must rely on the vendor's upcoming documentation for precise mitigation steps and affected components.
The background
A leak on October 20, 2026, circulated claims about two flaws affecting PHP versions from 5 onward. The leaker assigned a CVSS score of 10.0, which differs from PHP's official 9.2 rating. WatchTowr confirmed the existence of the vulnerabilities but noted that the scope remains unverified by the vendor. PHP maintainers said they could release patches earlier if vulnerability details become public or evidence of active exploitation emerges.
What changes now
PHP will provide updates only for its four supported branches: 8.2, 8.3, 8.4, and 8.5. Versions prior to 8.2, including 8.1 and older releases, are end of life. These legacy versions will not receive a security fix from the vendor. Organizations using outdated PHP branches must plan for migration or alternative remediation strategies immediately.
Who needs to act first
Teams usually prioritize systems exposed to the public internet when facing remote code execution threats. Check whether your web servers run supported PHP branches before attempting updates. Back up configurations and databases to ensure recovery if the patch causes compatibility issues. Test the update in a staging environment that mirrors production settings. Roll out the fix to non-critical services first to verify stability. Monitor logs for unusual activity during the transition period. Coordinate with application developers to ensure code compatibility with the new version.
What to do and how to stay safe: PHP
- Identify all servers running PHP versions 8.2 through 8.5 and prepare them for the vendor update.
- Isolate systems running unsupported PHP versions from direct network exposure until a migration plan is ready.
- Monitor server logs for unexpected process executions or unauthorized script activity following the patch deployment.
- Review web server configurations to ensure strict input validation remains active while awaiting vendor guidance.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by these critical vulnerabilities?
Only PHP versions 8.2 through 8.5 receive official fixes, as older versions are end of life.
Has anyone exploited these vulnerabilities in the wild?
WatchTowr reported no known exploitation as of October 21, 2026, but this does not rule out future attacks.
What are the CVE identifiers for these flaws?
Researchers use CVE-2026-109618 and CVE-2026-109619, though PHP has not officially linked these IDs to the scores.
