Key points
- Two remote code execution flaws, rated 9.2 CVSS, affect PHP versions 5, 6, 7, and 8.
- Emergency patches are scheduled for release on October 21 at 14:00 UTC, though earlier release is possible.
- Security researchers confirm the vulnerabilities are real, but public exploitation has not yet been observed.
Administrators managing PHP infrastructure must prepare for emergency security updates scheduled for October 21 at 14:00 UTC. The PHP development team announced these patches address two severe vulnerabilities, each carrying a Common Vulnerability Scoring System rating of 9.2. The advisory urges all users to ready their systems for immediate installation once the fixes become available.
In plain English
The flaws allow attackers to run arbitrary code on servers using PHP versions 5 through 8. Security researchers at watchTowr confirmed the existence of CVE-2026-109618 and CVE-2026-109619, describing them as remote code execution issues. Although technical details remain under embargo, the potential impact is severe because PHP powers a vast portion of the web, including major content management systems and e-commerce platforms.
View the original post on X
The background
Information regarding these vulnerabilities reportedly leaked before the scheduled disclosure date. A video circulating online demonstrated an exploit tool named PHP2Shell executing code on various platforms, including WordPress, Drupal, and Magento. While the maintainers have not confirmed the video’s authenticity, watchTowr stated it successfully reproduced one of the flaws. No evidence of active exploitation in the wild has been reported.
What changes now
The PHP team reserved the right to release patches earlier than planned if details become public or exploitation evidence appears. Security firms Sansec and Webfence warned that mass attacks could begin shortly after the patch release. Huntress also issued an advisory. Administrators are advised to monitor the PHP.net homepage for late-breaking announcements regarding accelerated release times or additional guidance.
Who needs to act first
Teams usually prioritize internet-facing systems with direct public access before internal tools. Identify the specific PHP versions running on each server to determine exposure levels. Create full backups of site files and databases before applying any updates to ensure recovery options exist. Test the patches in a staging environment first to verify compatibility with existing applications. Isolate non-essential systems from the network until they are patched to reduce the attack surface during the transition period.
What to do and how to stay safe: PHP
- Inventory all servers and applications running PHP to identify which versions are affected by these specific CVEs.
- Prepare maintenance windows starting at the scheduled release time, with contingency plans for an earlier emergency drop.
- Back up all website files and database configurations before attempting to install the security updates.
- Monitor official PHP communication channels for real-time updates on patch availability and early release decisions.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by these vulnerabilities?
According to watchTowr, the flaws affect PHP versions 5, 6, 7, and 8.
Is there evidence that these vulnerabilities are being exploited in the wild?
Researchers have confirmed the vulnerabilities are real, but they have not observed active exploitation in the wild.
When will the security patches be released?
The PHP team plans to release updates on October 21 at 14:00 UTC, but may release them earlier if necessary.
