PHP Sets October 21 Patch Release for Two 9.2-Rated Flaws After Leak

The PHP development team said it will release security updates on Wednesday, October 21 at 14:00 UTC to fix two vulnerabilities, after details of the flaws reportedly leaked ahead of schedule, according to BleepingComputer. Each vulnerability is rated 9.2 under CVSS v4.0 by the PHP security team.

The team sent a notice to its ANNOUNCE mailing list urging administrators to install the updates as soon as they are available. It added that it reserves the right to release the updates earlier if details become public or evidence of active exploitation appears. PHP has not disclosed which PHP versions are affected or which releases will contain the fixes.

Security research firm watchTowr told BleepingComputer the flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are believed to affect PHP versions 5, 6, 7 and 8. watchTowr CEO Benjamin Harris said the two remote code execution vulnerabilities leaked in the previous hour and had previously been scheduled for release on Thursday at 11 am ET.

watchTowr said in a post on X that information about the embargoed zero-day RCE vulnerabilities in PHP had leaked. The firm said it believes it has reproduced CVE-2026-109618 but will not release technical information until patches are available, and that it has not observed exploitation in the wild.

A now-deleted Hacker News post by user petecooper claimed the two flaws would be disclosed on October 22 and carried CVSS scores of 10.0. The PHP security team says it will publish full technical details, affected versions and fixed releases when the updates become available.

What administrators should watch for

PHP powers many websites and web applications, including content management systems, e-commerce platforms and custom web services. The team's guidance for now is to apply the October 21 updates as soon as they are published, with the release timing potentially moving up.