Organisations urged to patch PHP 5-8 ahead of Oct 21 fixes after critical RCE flaws leak early

The PHP development team announced it will release security updates on Wednesday, October 21, at 14:00 UTC to address two critical vulnerabilities. Each flaw carries a severity rating of 9.2 under CVSS v4.0. The team noted it may release patches earlier if exploitation evidence emerges.

How it unfolded

• The PHP security team published an advisory on Tuesday regarding two upcoming vulnerabilities.
• watchTowr reported that details about the flaws leaked ahead of the scheduled Thursday disclosure.
• The team confirmed it plans to issue patches on October 21 at 14:00 UTC.

Who is affected

Security researchers at watchTowr stated the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP versions 5, 6, 7, and 8. These versions power many web applications, including WordPress, Magento, Joomla, and Drupal. An unconfirmed report showed an exploit tool targeting sites running these platforms.

Our take on the response

The PHP team urged all users to prepare for immediate upgrades upon release. It reserved the right to publish patches earlier if public details or active exploitation appeared. watchTowr confirmed the vulnerabilities are real but withheld technical specifics to prevent misuse.

Who needs to act first

Teams should prioritize systems exposed to the internet, as remote code execution allows attackers to run commands without user interaction. Identify all servers running PHP versions 5 through 8 and create full backups of site files and databases before applying any changes. Test patches in a staging environment to ensure compatibility with existing applications. Isolate non-essential systems that cannot be patched immediately to reduce the attack surface. Monitor vendor channels for early release announcements.

What to do and how to stay safe: PHP

• Inventory all servers and applications running PHP versions 5, 6, 7, or 8.
• Schedule a maintenance window starting at 14:00 UTC on October 21 for patching.
• Create complete backups of web servers and databases before applying updates.
• Monitor the PHP.net homepage for announcements regarding an earlier release time.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions are affected by these vulnerabilities?

watchTowr stated the flaws affect PHP versions 5, 6, 7, and 8.

What is the severity rating of these flaws?

The PHP team rated both vulnerabilities at 9.2 under CVSS v4.0.

Are there confirmed exploits in the wild?

watchTowr said it has not observed exploitation in the wild despite the leak.