PHP warns of critical RCE flaws after early details leak

The PHP security team said in an advisory that the upcoming security release would address two critical vulnerabilities, both rated CVSS v4.0 9.2. It said all PHP users should prepare now so they can upgrade as soon as the release is available. The release was scheduled for Wednesday, 21 October 2026 at 14:00 UTC. PHP said it reserved the right to release earlier if details of either vulnerability became public or if evidence of active exploitation appeared. Full details, affected versions and fixed versions were to be published with the release.

According to the advisory, the flaws could expose websites to remote code execution attacks. The original report said such flaws could lead to website takeovers, data theft, malicious redirects and similar attacks.

The early advisory followed a leak of the vulnerabilities before the official embargo was lifted. A user with the alias “petecooper” published a post on Y Combinator’s Hacker News forum earlier this week claiming that PHP would disclose two remote code execution bugs on 22 October 2026. The post was later deleted, and TechRadar said it could not independently verify it, but BleepingComputer reported that the post claimed the bugs carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5. The post also named the flaws as CVE-2026-109618 and CVE-2026-109619. Those identifiers were subsequently confirmed, according to the report, while the CVSS score in the advisory was 9.2, not 10.0.

Florian Roth, head of research at Nextron Systems, also posted about the flaw before the patch was released. On X, Roth said an RCE vulnerability in PHP core was rated CVSS 10.0, that further details were scheduled for release on 20 October, and that only PHP 8 would receive patches. That account conflicted with PHP’s advisory, which did not limit the upgrade warning to PHP 8 and said all PHP users should prepare for the release.

Security researchers at watchTowr confirmed the vulnerabilities. Benjamin Harris, the company’s CEO, told BleepingComputer that two remote code execution vulnerabilities in PHP had been leaked in the previous hour and had previously been scheduled for release under embargo on Thursday at 11 a.m. ET. He said technical information could not be shared at that point because of the sensitivity of the matter, but confirmed that the vulnerabilities were real. Harris said both were CVSS 10 and were understood to affect PHP versions 5, 6, 7 and 8. The researchers also told BleepingComputer that they had successfully reproduced CVE-2026-109618, confirming that the flaw worked.

The report said there were still no confirmed reports of the flaws being used as zero-days in the wild. PHP’s advisory did not provide technical details ahead of the scheduled release, and the company urged users to be ready to upgrade once the patch became available.

Editor's Summary

PHP has issued an early advisory for two critical remote code execution vulnerabilities rated CVSS v4.0 9.2, with a patch scheduled for 21 October 2026. Details leaked before the release, and researchers confirmed the flaws are real, while accounts differed over whether the severity was 9.2 or 10.0 and which PHP versions would receive fixes. No confirmed active exploitation had been reported.