PHP Warns of Two Critical 9.2 Vulnerabilities, Urges Prompt Patching
PHP has alerted users to two critical vulnerabilities, each with a CVSS score of 9.2, expected to be patched on October 21, 2026, with potential remote code execution implications.
The PHP security team has issued an advance warning regarding two critical vulnerabilities, each carrying a CVSS v4.0 score of 9.2. These flaws are slated for patching on October 21, 2026, at 14:00 UTC, providing website administrators and hosting providers a narrow window to prepare for the upcoming security release. PHP has indicated that full technical details, affected versions, and the fixed releases will be published concurrently with the patches.
While no exploitation in the wild is currently known, the PHP team may expedite the release of updates if either vulnerability becomes publicly disclosed or if evidence of active attacks emerges. Publicly referenced as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities are described by security firm watchTowr as potential remote code execution flaws. Such vulnerabilities could allow attackers to execute their own code on affected servers, posing a significant risk.
However, PHP's initial advisory does not provide specific technical details on how these flaws work or name the CVEs directly. CERT-EU's advisory also references both identifiers and warns of possible remote code execution without authentication, noting that its assessment draws partly on leaked information. This distinction is important for administrators to consider, separating the vendor's confirmed facts from external reports.
Reports suggest that the vulnerabilities could potentially affect PHP versions from PHP 5 onwards, though the vendor has not yet confirmed this broad claim. PHP has also not yet determined whether default installations are vulnerable, what specific configurations are required for exploitation, or if certain operating systems face a greater risk. While some early reports mentioned a maximum severity score of 10.0, PHP's official rating of 9.2 under CVSS v4.0 for each vulnerability should guide immediate risk assessments until further details emerge.
At the time of PHP's advisory, watchTowr reported no known exploitation in the wild. The warning about a potential early release is a precautionary measure, not an indication of active attacks. Claims involving leaked demonstrations or exploit code should be treated with caution and not as definitive proof of attacks against real-world targets.
Past incidents underscore the importance of prompt patching. For instance, the exploitation of CVE-2024-4577, a separate PHP flaw, saw exploit attempts detected within 24 hours of its disclosure. While this history highlights the need for swift action, it does not confirm exploitation of these new vulnerabilities. Administrators should also note that previous PHP vulnerabilities, such as those in the SOAP extension earlier in 2026, involved different components and fixes, and patching those will not address these new issues.
CERT-EU recommends that organizations identify all PHP applications immediately and prepare to patch affected systems as soon as the fixed versions become available. For environments where immediate patching is not feasible, isolating internet-facing applications from public networks until a fix can be applied should be considered, carefully balancing this with service availability and business needs.
As the release date approaches, teams should confirm ownership of each PHP installation and establish clear procedures for deploying updates to production systems. Upon the release of the patches, administrators must verify the official affected-version list, apply the relevant fixes promptly, and confirm the running PHP version afterward. Until then, no deployment should be considered secure based solely on configurations differing from circulating online claims.
The new article, "PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert," provides additional technical details and context surrounding the PHP vulnerabilities. It names the researchers at watchTowr who confirmed the leak and highlights the specific CVE identifiers, CVE-2026-109618 and CVE-2026-109619, that were leaked. Furthermore, it details the differing CVSS scores assigned by the leak (10.0) versus PHP's official rating (9.2) and discusses the potential scope of affected versions, noting that PHP will only patch supported branches 8.2 through 8.5.
This week's "Risky Business" podcast elaborates on the critical PHP vulnerabilities, noting that eight private keys for CA certificates with only 8 bits of entropy were compromised. This alarming discovery has placed the internet on high alert, with the PHP Foundation preparing patches for these critical bugs that could potentially impact TLS security across numerous websites.
The new article provides specific guidance for administrators preparing for the PHP security release, including steps like inventorying PHP installations across various environments (web servers, containers, CI images, dev machines), identifying update responsibilities (especially for managed/shared hosting), and checking for unsupported PHP versions. It also offers a tip for WordPress users to check their PHP version via the Site Health tool.