PHP critical security release due Oct 21: what is confirmed about the two CVSS 9.2 flaws

Update note: this is an early alert. It was written before the release. This article will be updated after PHP publishes the fixed versions and full details.

What happened

On 20 October 2026, the PHP security team posted an advance notice on php.net. The same notice went to the php-announce mailing list as message #509, signed by Jakub Zelenka.

PHP says a security release is scheduled for Wednesday 21 October 2026 at 14:00 UTC. It fixes two critical vulnerabilities. Each one is rated CVSS 4.0 9.2.

Earlier the same day, a Hacker News post claimed two PHP RCE bugs were coming. It named two CVE IDs. The security firm watchTowr later said the bugs are real.

Who is affected

PHP has not said yet. The notice says full details, affected versions and fixed versions will come with the release.

The supported PHP branches today are 8.2, 8.3, 8.4 and 8.5. Their latest releases are 8.2.34, 8.3.35, 8.4.26 and 8.5.11, all from 24 September 2026.

Reports say every version from PHP 5 onward is affected. PHP has not confirmed this. Versions that are end of life may not get a fix.

What is confirmed

These points come from PHP itself:

• Date. The release is set for 21 October 2026 at 14:00 UTC.
• Count. It fixes two vulnerabilities.
• Severity. PHP calls both critical. Each is rated CVSS 4.0 9.2.
• Earlier release possible. PHP may ship sooner if details go public or attacks appear.
• Details later. Affected and fixed versions will be published with the release.

Other checks, as of 20 October 2026, 23:55 UTC:

• No public record. NVD and CVE.org have no published record for either reported ID.
• No advisory yet. The php-src GitHub repository has no security advisory for them.
• No official ID mapping. PHP, php-announce and the oss-security repost of the notice name no CVE ID.
• Not in KEV. Neither reported ID is in the CISA KEV catalog.
• No public PoC. ThreatWire found no public proof of concept.

What is not confirmed

These claims come from the leak and from watchTowr, not from PHP:

• CVE IDs. The reported IDs are CVE-2026-109618 and CVE-2026-109619. PHP's notice does not name any ID.
• Impact. The leak and watchTowr call both bugs remote code execution. PHP has not said what they do.
• Scope. The leak says all versions from PHP 5 onward are affected. watchTowr says PHP 5, 6, 7 and 8. PHP 6 was never released.
• Score. The leak and watchTowr's CEO quoted CVSS 10.0. PHP rates each flaw 9.2 under CVSS 4.0.
• Date. The leak said disclosure was planned for 22 October. PHP scheduled the release for 21 October.
• Fixed versions. Researcher Kevin Beaumont posted that the fixes will be 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP has not published version numbers.
• CERT-EU. CERT-EU advisory 2026-018 uses both IDs. It cites the PHP notice for the 9.2 scores and the leak reports for the RCE impact and PHP 5 scope.

watchTowr told BleepingComputer it reproduced one of the bugs. It keeps the details private until patches ship. It says it has seen no exploitation in the wild.

The leak first appeared in a Hacker News post. Its author wrote that the claim rested only on trust in a source.

What to do now

1. Inventory PHP. List PHP versions on servers, containers and base images. Include CLI, FPM and Apache module builds.
2. Plan a patch window. Book an emergency window right after 14:00 UTC on 21 October.
3. Watch your distro. Debian, Ubuntu, Red Hat and others ship their own PHP packages. Track their updates too.
4. Flag end-of-life PHP. Versions older than 8.2 may not get a fix. Plan an upgrade path.
5. Prioritise exposed apps. Start with internet-facing PHP applications. Wait for PHP's advisory before acting on unconfirmed details.

PHP powers many CMS and framework stacks we track. See recent PHP-ecosystem coverage, like the Drupal core Field UI RCE (CVE-2026-108097) and the Smarty cache injection (CVE-2026-82531). Browse all records in the CVE tracker and actively exploited CVEs.

Sources: the PHP news archive, php-announce #509, the oss-security repost, PHP supported versions, the watchTowr FAQ, BleepingComputer, the Hacker News post and CERT-EU advisory 2026-018. Links are in the references list.