PHP maintainers have scheduled emergency security patches for October 21, 2026, to address two critical remote code execution vulnerabilities affecting all versions from PHP 5 onward, according to multiple verified reports.
The PHP development team confirmed plans to release emergency security updates on Wednesday, October 21, 2026, at 14:00 UTC to address two critical vulnerabilities rated 9.2 on the CVSS scale. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could enable unauthenticated remote code execution. Security firms and developers issued warnings.
Leaked Details Prompt Urgent Preparations
Security researcher Benjamin Harris of watchTowr confirmed the vulnerabilities are real, stating they affect PHP versions 5, 6, 7, and 8. We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real,
Harris said. The PHP Foundation warned administrators to prepare for immediate patching. Details of the flaws have already surfaced online.
CERT-EU advised organizations to isolate internet-facing applications until fixes are available. The PHP team emphasized its right to release updates earlier if exploitation is detected. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,
the advisory stated.
A video demonstrating an exploit tool named PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9 was reported. Attempts to locate the unconfirmed report were unsuccessful. watchTowr confirmed the vulnerabilities affect every PHP version from PHP 5, released in 2004, onward.
Conflicting Reports Emerge on Vulnerability Severity
Discrepancies exist between sources regarding the vulnerabilities’ severity. BleepingComputer cited reports of CVSS 10.0 scores. The PHP Foundation assigned 9.2 under CVSS v4.0. A deleted Hacker News post claimed the flaws would be disclosed on October 22. watchTowr and PHP officials confirmed the official release date as October 21.
We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619We cannot share further information right now. Take this seriously and apply patches when available. pic.twitter.com/kguM8fpq13
Technical details remain limited. The PHP team has not yet disclosed affected versions, exploit methods, or fixed releases. watchTowr reported successfully reproducing CVE-2026-109618.
On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks. No technical details were made public at the time. CERT-EU emphasized that organizations should prepare for immediate patching of affected assets. Recommendations include isolating internet-facing applications if remediation is not feasible.
Industry Prepares for Security Release
Major platforms like Laravel and WHMCS are preparing updates. Laravel announced plans to integrate patched versions into its base images. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,
the advisory stated.
The PHP Foundation’s security release is scheduled for 14:00 UTC on October 21. Full technical details, affected versions, and fixed releases will follow. Organizations are urged to monitor official channels for updates. Apply patches promptly to mitigate risks.
watchTowr noted that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution (RCE) flaws believed to affect PHP versions 5, 6, 7, and 8. The firm confirmed the vulnerabilities are real. It withheld technical information until patches are available. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
The PHP security team has scheduled the release for 21 October 2026 at 14:00 UTC. The Laravel team announced both Forge and Cloud will be updated as well with a fix to a second node.js security issue. The PHP and Node.js teams have both announced security releases for Wednesday, October 21. PHP’s is scheduled for 14:00 UTC. Node.js hasn’t confirmed a time yet.