Threat Advisory: Critical PHP Security Updates Pending — CVE-2026-109618 and CVE-2026-109619

Information verified through 7:31 p.m. EDT

The PHP security team has announced an upcoming release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. Updates are scheduled for Wednesday, October 21, 2026, at 14:00 UTC — 10:00 a.m. EDT. PHP users have been advised to prepare for immediate upgrades. The team may release the updates earlier if vulnerability details become public or evidence of active exploitation emerges. ¹

Public reporting associates these vulnerabilities with CVE-2026-109618 and CVE-2026-109619. PHP’s advance notice does not identify the CVEs or describe the underlying flaws. Both official CVE records remained RESERVED when checked, without published technical descriptions. ^2, 3

Security firm watchTowr describes the issues as remote code execution vulnerabilities, potentially allowing an attacker to execute code on an affected server. Its published FAQ qualifies the reported scope as unconfirmed by a vendor advisory. The exact attack requirements, affected configurations and technical causes remain unresolved in the public information reviewed for this notice. ⁴

Information about the vulnerabilities circulated publicly on October 20 before the planned coordinated disclosure. The following sources document that circulation:

• Hacker News: A post by user petecooper, titled “Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming,” named both CVEs, described potential exposure extending back to PHP 5, and identified October 22 as the expected disclosure date. The author cited an unnamed source and explicitly acknowledged having no supporting evidence. The post was accessible during this review. ⁵
• Mastodon: Kevin Beaumont posted that information about both CVEs had leaked before patches were available. His post included an attached image and generated further discussion about what had actually been disclosed. ⁶
• X: watchTowr stated that information about embargoed PHP remote code execution vulnerabilities had leaked and confirmed that the vulnerabilities were real. The company said the expected embargo had been Thursday at 11:00 a.m. Eastern and withheld further technical information. ⁷
• Additional public warnings: Florian Roth described a PHP core remote code execution issue and repeated the preliminary 10.0 severity claim. Nicolas Krassas announced plans to release a lab after the embargo lifted. These posts document public discussion and planned research publication; they do not supply a vendor-confirmed description of the attack conditions. ^8, 9

A video labeled “php2shell” also circulated on X through Kirill Firsov. In a subsequent reply, Firsov credited @lcfr_hax and Calif for the video and exploit. Its association with a specific CVE, required configuration and applicability across PHP applications have not been independently verified for this advisory. ^10, 11

These sources establish public circulation through Hacker News, Mastodon and X. They do not establish the identity of the original private source or whether complete exploit code was shared privately.

There are also public claims of successful reproduction. watchTowr told BleepingComputer that it believed it had reproduced CVE-2026-109618, while withholding technical information until patches became available. Previdian separately stated that it had reproduced the PHP vulnerabilities. These remain attributed researcher statements; this advisory does not independently validate their results. ^12, 13

watchTowr also told BleepingComputer that it had not observed exploitation in the wild. That describes the company’s observations at the time of its statement. It does not establish that exploitation has not occurred elsewhere. Predictions about attacks beginning within minutes of disclosure remain speculation. ¹²

Several details circulating online require qualification. Early posts described the vulnerabilities as CVSS 10.0 and referenced an October 22 disclosure. PHP’s published notice specifies CVSS v4.0 9.2 and an October 21 release. Those are the official severity and scheduling details available at the time of this notice. PHP says affected versions and fixed versions will be published with the release. ¹

Reports that the vulnerabilities affect PHP 5 and later have not yet been substantiated by a complete vendor-published affected-version list. Beaumont has identified 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as the forthcoming fixed releases. That version list should be treated as a researcher report pending confirmation in PHP’s release documentation. ^4, 14

Claims that all PHP 8 releases will receive patches are also unsupported by the advance notice. PHP’s currently supported branches are 8.2, 8.3, 8.4 and 8.5. PHP 8.0 and 8.1 are outside upstream support. Organizations using older versions should confirm their remediation options with their operating-system vendor, hosting provider or extended-support provider. ¹⁵

AHCTS recommends identifying PHP installations and the teams or providers responsible for updating them, preparing an expedited deployment process, and verifying the running PHP version after updates are installed. For managed hosting, obtain confirmation of the PHP runtime update for each affected service.

CERT-EU has likewise advised organizations to identify PHP-based applications and prepare to patch promptly. Where immediate remediation is not feasible, it recommends considering isolation of internet-facing applications until a fix can be applied. ¹⁶

AHCTS will publish an additional update after PHP releases the security fixes and technical advisory. That update will cover confirmed affected versions, fixed releases, and any verified exploitation or mitigation information available at that time.