The PHP security team announced an emergency update to address two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. These flaws are classified as remote code execution (RCE) vulnerabilities, which could allow unauthorized access or server takeover.
The official release of the security patches is scheduled for Wednesday, October 21, at 14:00 UTC. The PHP team assigned a severity score of 9.2 to both vulnerabilities under the CVSS v4.0 system, though some researchers suggest a higher rating.
Information regarding these flaws leaked online before the coordinated disclosure, prompting urgent warnings for administrators. Cybersecurity firm watchTowr confirmed the existence of the vulnerabilities and reported that they may affect multiple PHP versions.
Infrastructure providers, including Cloudflare, have reported early signs of exploitation attempts. The PHP team advises administrators to prepare their systems for immediate upgrades as soon as the official patches become available.
