Critical PHP Zero-Day Vulnerabilities Leaked, Patches Expected October 22

On October 20, 2026, details of two critical remote code execution vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, leaked online with a maximum CVSS score of 10.0[1][5][8]. The premature disclosure occurred before official patches were released for the zero-day flaws[1][8].

This leak has put system administrators globally on alert as it revealed severe, unpatched security vulnerabilities in PHP, a widely used scripting language for web development[1][8][17]. The information became public before fixes were available, creating a window where systems running vulnerable PHP versions could be at risk of attack[1][8]. For organizations still using older, unsupported PHP versions, the risk is persistent, as patches will reportedly only be released for PHP 8[8][17].

What the records show

Following this initial leak, security firm WatchTowr publicly confirmed the authenticity of the zero-day vulnerabilities on October 20, 2026[8][17]. WatchTowr stated the leak was premature, as a coordinated disclosure had been planned for Thursday[8][17]. The company urged administrators to treat the situation seriously and to apply patches once they become available[8][17]. Security researcher Florian Roth also commented on the matter via X, stating that the vulnerabilities are RCE flaws within the PHP core and that only PHP 8 would receive patches[8][17]. This means PHP versions from 5 up to 7.x are expected to remain vulnerable[8][17].

The timeline

What changed and for whom

What the subject has said publicly

What we could not confirm