The PHP development team has issued a warning about two significant security vulnerabilities, urging administrators to prepare for a forthcoming patch release. Both vulnerabilities have been assigned a high severity score of 9.2 under the CVSS v4.0 system. The scheduled update is set for release on Wednesday, October 21, 2026, at 14:00 UTC, which provides a limited timeframe for website owners and hosting providers to make necessary preparations.
Upcoming Security Patch Details
On October 20, PHP released an official security notice indicating that full technical details, including affected versions and fixed releases, will be made available alongside the patches. The team mentioned the possibility of releasing updates sooner if the vulnerabilities are publicly disclosed or if active exploitation is detected.
The vulnerabilities are linked to CVE-2026-109618 and CVE-2026-109619, which are described as remote code execution risks by the security company watchTowr. These flaws could potentially allow attackers to execute arbitrary code on compromised servers. However, PHP has not confirmed the specifics of these CVEs or detailed the exact nature of the vulnerabilities.
Implications for PHP Versions
CERT-EU has issued an advisory referencing these identifiers, warning of potential unauthenticated remote code execution. This assessment is partially based on leaked information. There is speculation that the vulnerabilities might affect PHP versions from PHP 5 onwards, though PHP has not confirmed this claim. The organization has yet to determine whether default installations are vulnerable, which settings might influence risk, or if certain operating systems are more susceptible.
Initial reports suggested the vulnerabilities had a severity score of 10.0, but PHP has confirmed a 9.2 rating under CVSS v4.0. This official score should guide reporting and risk assessment until further details are released.
Strategies for Immediate Response
As of now, watchTowr reports no known exploitation of these vulnerabilities in the wild. PHP’s notice about a potential early patch release is a precautionary measure rather than an indication of active attacks. Previous incidents, such as the exploitation of CVE-2024-4577, highlight the urgency of patching, with exploit attempts occurring within a day of disclosure.
CERT-EU advises administrators to identify PHP applications and prepare to apply patches promptly once available. If immediate patching is not feasible, organizations should consider isolating internet-facing applications to reduce risk until a fix is applied. Such decisions should balance security with service availability and business requirements.
During this preparation phase, teams should verify management responsibilities for PHP installations and outline how updates will be deployed in production environments. Once the patches are released, it is crucial to consult the official affected-version list, apply updates swiftly, and confirm the PHP version in use. No deployment should be presumed secure based solely on differing configurations from unofficial claims.
