PHP to Release Emergency Patches for Two Critical RCE Vulnerabilities After Leak

The PHP security team is scheduled to release emergency security patches on Wednesday, October 21, 2026, at 14:00 UTC (10:00 AM Eastern), to address two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619[2][6][15]. This urgent response comes after details about these flaws were prematurely leaked on October 20, 2026, ahead of their originally embargoed disclosure[9][10].

These vulnerabilities pose a significant risk because PHP powers approximately 75% of all websites that use a known server-side programming language, including platforms like WordPress, Drupal, and Joomla[8]. Attackers could exploit these flaws to run their own code on affected servers, potentially compromising a vast number of websites globally[13][14].

What the records show

The PHP security team has confirmed that an upcoming security release is scheduled to fix two critical vulnerabilities[9][15]. These flaws are identified as CVE-2026-109618 and CVE-2026-109619[10]. Cybersecurity firm watchTowr has confirmed the legitimacy of these vulnerabilities[10][13]. An alleged exploit tool named 'PHP2Shell' has been reported in connection with these vulnerabilities[1][16]. Both vulnerabilities are rated 9.2 under CVSS v4.0[6]. Initial reports indicate these vulnerabilities may affect all PHP versions from 5 onward[13].

The timeline

On October 20, 2026, details regarding the two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked online[9][10]. This leak occurred before their planned coordinated disclosure and before any patches were made available[9]. Following the leak, the PHP security team announced an upcoming security release to address these issues[9][15]. The patches are scheduled for release on Wednesday, October 21, 2026, at 14:00 UTC[6][7].

What changed and for whom

The premature leak of vulnerability details has accelerated the release schedule for patches, requiring immediate attention from web administrators globally[10][14]. Websites running PHP versions 5.4 or later are potentially affected and will need to apply these fixes promptly once released[12]. The widespread use of PHP means a large segment of the internet is at risk, including sites built with WordPress, Drupal, Joomla, Laravel, Symfony, and Magento[8].

What the subject has said publicly

The PHP security team issued an advisory notifying administrators to prepare for an upcoming security release to address two critical vulnerabilities[2][7]. They have stated the release is scheduled for Wednesday, October 21, 2026, at 14:00 UTC[6][7]. They did not publicly confirm the leak of details, but their accelerated patch schedule follows reports of such a leak[2][9][15].

What we could not confirm

We could not confirm the exact technical details of the vulnerabilities (CVE-2026-109618 and CVE-2026-109619), as no official technical details have been made public yet[11]. The exact mechanism of the 'PHP2Shell' exploit tool and its direct connection to these specific vulnerabilities beyond unconfirmed reports also remains unconfirmed[1]. While some reports suggest the vulnerabilities affect PHP 5 and later, this has not been confirmed by a vendor advisory[13].