PHP Plans Emergency Security Release for Two Critical RCE Flaws

Emergency Release Scheduled

PHP will ship an out-of-cycle security release at 14:00 UTC on October 21, 2026, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale. The flaws allow remote code execution, according to researchers at watchTowr. No exploitation has been reported so far. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix. PHP may release earlier should details become public, or should evidence of active exploitation appear.

Leak Prompted Early Notice

On October 20, a post on Hacker News claimed that two PHP remote code execution flaws rated CVSS 10.0, affecting versions from PHP 5 onward, would be disclosed on October 22. The poster provided no verifiable evidence. watchTowr later confirmed the leaked information was real and that the flaws were under embargo. PHP published its advance notice on October 20 at 19:33 UTC, scheduling the release for October 21, a day before the date in the leak. The leak included two CVE identifiers, CVE-2026-109618 and CVE-2026-109619, but PHP's notice names neither. The claim that every version since PHP 5 is affected remains unconfirmed by an official advisory.

Supported Branches and Expected Versions

PHP issues fixes only for its four supported branches. Versions 8.2 and 8.3 receive only security fixes until December 31, 2026, and December 31, 2027, respectively. Versions 8.4 and 8.5 are in active support until December 31, 2026, and December 31, 2027, respectively. Trackers including Alpine Linux and security researcher Kevin Beaumont expect the fixes to ship as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, though PHP has not confirmed the numbers. Branches older than 8.2, including 8.1, 8.0, 7.x, and 5.x, are end of life and will receive no vendor patch.

Mitigation Guidance for Administrators

PHP has published no workaround. Administrators should inventory every PHP installation, including those bundled in vendor appliances, Windows software, and control panels such as cPanel and Plesk. Be ready to upgrade at 14:00 UTC. Patch internet-facing systems first, and check Linux distributions and hosting providers for backported packages. On end-of-life branches, upgrade, take the system off the internet, or put it behind a VPN or web application firewall. CERT-EU advises isolating internet-facing applications from public networks until a fix is available. Monitor for php-fpm, php-cgi, httpd, or apache2 launching shells, interpreters, or download tools. Florian Roth's process-watcher logs every program a PHP process starts but prevents nothing. If suspicious activity is found, isolate the server, preserve logs, and look for web shells, new files in the web root, new cron jobs, scheduled tasks, and accounts. As of October 21, no exploitation has been reported and the flaws are not in CISA's Known Exploited Vulnerabilities catalog.

Sources: The Hacker News · Ars Technica · Php.Net