Overview of the Security Release

On October 21, 2026, at 14:00 UTC, PHP is set to roll out an important out-of-cycle security update addressing two vulnerabilities classified with a high severity rating of 9.2 on the CVSS v4.0 scale. While the details surrounding these vulnerabilities have not been disclosed, the security implications are clear.

Nature of the Flaws

Security researchers from watchTowr have indicated that the identified vulnerabilities could enable remote code execution. Notably, this patch will only be available for the currently supported PHP branches, specifically versions 8.2 through 8.5. To date, no reports of these vulnerabilities being exploited have surfaced.

The Leak and Its Implications

The announcement follows a leak on October 20 when a post on Hacker News alerted the community to two critical remote code execution vulnerabilities that allegedly affect all PHP versions since 5. This leak described the vulnerabilities with a CVSS score of 10.0 but lacked concrete evidence. Following the leak, watchTowr confirmed the authenticity of the information and indicated that further details were under embargo until the official release.

Response from PHP

PHP officially published a security notice on the evening of October 20, denoting that it may release the fix earlier depending on whether the details of the vulnerabilities became public or if evidence of active exploitation emerged. The security notice listed CVE identifiers CVE-2026-109618 and CVE-2026-109619 in the leaked information, although PHP’s announcement did not name these specific identifiers.

Support for Affected Versions

The following PHP branches are eligible to receive the security fix:

• PHP 8.5 – Current release: 8.5.11 (Active support until December 31, 2027)
• PHP 8.4 – Current release: 8.4.26 (Active support until December 31, 2026)
• PHP 8.3 – Current release: 8.3.35 (Security fixes only until December 31, 2027)
• PHP 8.2 – Current release: 8.2.34 (Security fixes only until December 31, 2026)

It is essential to note that versions older than 8.1 have reached their end of life and will not receive any patches.

Preemptive Measures for Users

As part of the ongoing preparations for the impending security update, users are advised to follow these guidelines:

1. Conduct an inventory of all PHP installations, including those bundled in vendor appliances and control panels like cPanel and Plesk.
2. Be ready to implement upgrades at 14:00 UTC, prioritizing patching for internet-facing systems.
3. For installations on end-of-life branches, consider taking the system offline or securing it behind a VPN or web application firewall.
4. Where immediate patching is not feasible, isolate internet-facing applications from public networks until fixes are available.
5. Monitor PHP processes and alert on any unusual actions, such as the launching of shells or interpreters.
6. If exploitation is suspected, isolate the server and analyze logs for any irregular activities.

Conclusion

As of October 20, no exploitation attempts related to these vulnerabilities have been observed by security firms, including Huntress and watchTowr. The release of the security patch will clarify the extent of the vulnerabilities and provide necessary fixes. Further information will be disclosed with the release, which is expected shortly.