The PHP security team announced an emergency update to address two critical remote code execution vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. These flaws have received a severity score of 9.2 in the CVSS v4.0 framework.
Security firm watchTowr confirmed that both vulnerabilities are zero-day remote code execution exploits affecting PHP version 5 and higher. The existence of these flaws was initially reported by users on Hacker News on October 20, with subsequent discussions appearing on X and Mastodon.
The official patch release is scheduled for October 21 at 14:00 UTC. The PHP team moved the release date forward from the original plan of October 22. Officials noted that the timeline could be accelerated further if technical details are leaked or active exploitation is detected.
Currently, there is no evidence of large-scale exploitation, and no temporary mitigation measures have been provided. Given that PHP powers platforms like WordPress, Drupal, and Magento, administrators are advised to verify their server versions and prepare for immediate updates.
