PHP's security team just confirmed two critical RCE flaws after a leak. Here's what you need to know.
Security researcher Florian Roth posted that there is an RCE vulnerability in PHP core, rated CVSS 10.0. He said details were due October 20 and that only PHP 8 would get patches. The post drew 53K views. The story spread after a leak broke the embargo, which watchTowr had expected to hold until Thursday at 11am ET.
The PHP Foundation then gave official advance notice. The security release is set for Wednesday, October 21, 2026 at 14:00 UTC, which is 10 AM EDT. It fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The official rating is CVSS v4.0 9.2, not the 10.0 circulating online. The team says it may release earlier if details become public or active exploitation shows up. Some posts quoted 9 AM EDT, and watchTowr's post misprinted the CVE year as 2926.
The leak is confirmed as real. watchTowr says the embargoed zero-days are real, and Previdian says it reproduced them. No technical details are public. Reports say the flaws touch PHP 5, 6, 7 and 8, but only 8.0 and up are expected to get fixes. That is unconfirmed. Researcher Nicolas Krassas plans to publish a lab on the bugs when the embargo lifts. Security commentators expect exploitation within minutes of the details dropping.
PHP runs Wikipedia, WordPress sites, WooCommerce stores, Drupal sites and Adobe Commerce storefronts.
Key numbers:
- 2 critical RCE vulnerabilities
- CVE-2026-109618 and CVE-2026-109619
- CVSS v4.0 9.2 officially, 10.0 in leaked reports
- Patch release: Oct 21, 2026, 14:00 UTC
- Patches expected for PHP 8.0 and up
PHP admins should inventory their hosts now and update as soon as the release lands.
https://www.php.net/archive/2026.php#2026-10-20-1
Security researcher Florian Roth posted that there is an RCE vulnerability in PHP core, rated CVSS 10.0. He said details were due October 20 and that only PHP 8 would get patches. The post drew 53K views. The story spread after a leak broke the embargo, which watchTowr had expected to hold until Thursday at 11am ET.
The PHP Foundation then gave official advance notice. The security release is set for Wednesday, October 21, 2026 at 14:00 UTC, which is 10 AM EDT. It fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The official rating is CVSS v4.0 9.2, not the 10.0 circulating online. The team says it may release earlier if details become public or active exploitation shows up. Some posts quoted 9 AM EDT, and watchTowr's post misprinted the CVE year as 2926.
The leak is confirmed as real. watchTowr says the embargoed zero-days are real, and Previdian says it reproduced them. No technical details are public. Reports say the flaws touch PHP 5, 6, 7 and 8, but only 8.0 and up are expected to get fixes. That is unconfirmed. Researcher Nicolas Krassas plans to publish a lab on the bugs when the embargo lifts. Security commentators expect exploitation within minutes of the details dropping.
PHP runs Wikipedia, WordPress sites, WooCommerce stores, Drupal sites and Adobe Commerce storefronts.
Key numbers:
- 2 critical RCE vulnerabilities
- CVE-2026-109618 and CVE-2026-109619
- CVSS v4.0 9.2 officially, 10.0 in leaked reports
- Patch release: Oct 21, 2026, 14:00 UTC
- Patches expected for PHP 8.0 and up
PHP admins should inventory their hosts now and update as soon as the release lands.
https://www.php.net/archive/2026.php#2026-10-20-1
