Emerging Vulnerabilities Alert

The PHP security team has issued a warning urging system administrators to brace for immediate security updates. This comes in response to two severe vulnerabilities that have inadvertently gained public attention before their official announcement.

Upcoming Security Updates

According to an advisory released by the PHP development team, security updates are slated to be issued on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern). These updates aim to rectify two vulnerabilities that hold a CVSS v4.0 rating of 9.2, indicating their critical nature.

Need for Urgent Action

In their communication to the ANNOUNCE mailing list, PHP’s security team emphasized the necessity for administrators to implement the updates without delay, post-release. They also mentioned a precaution, stating, “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

Details on the Vulnerabilities

As of now, technical specifics regarding the vulnerabilities have not been disclosed, including the PHP versions affected or the nature of their exploitations. Industry security researchers from watchTowr identified these vulnerabilities as CVE-2026-109618 and CVE-2026-109619, categorized as remote code execution (RCE) flaws impacting PHP versions 5, 6, 7, and 8.

Confirmation of Vulnerabilities

In a recent communication, watchTowr CEO Benjamin Harris confirmed the authenticity of the vulnerabilities, stating, “In the last hour, two remote code execution vulnerabilities in PHP have been leaked.” He noted that while the technical details cannot be shared at this time, it has been confirmed that both vulnerabilities are legitimate.

Current Exploitation Status

Despite the leak of information, researchers reported no evidence of active exploitation in real-world scenarios as of yet. This update has surfaced in response to a now-removed post on the Y Combinator Hacker News forum, where a user shared insights about these vulnerabilities, citing their critical scores and affected PHP versions.

Disparity in Vulnerability Ratings

Interestingly, while both watchTowr and the forum user referred to the vulnerabilities as CVSS scores of 10.0, the official rating from the PHP security team remains at 9.2. Furthermore, the timing of the announcements diverged, with PHP scheduling its update for tomorrow unlike an initially expected later date by others.

Next Steps

As the scheduled update approaches, the PHP security team assured users that detailed insights, including affected versions and available fixes, will be made public when the updates are rolled out.