PHP Users Must Patch Two Critical RCE Flaws by October 21

PHP has announced that patches for two critical-severity vulnerabilities are scheduled for release on October 21, 2026. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 each. According to CERT-EU, this rating indicates that attackers can exploit these defects without authentication. The PHP project urged defenders to prepare for immediate patching as soon as the updates become available.

How it unfolded

• Details on the two vulnerabilities were leaked online before the coordinated disclosure date.
• PHP warned on Tuesday that patches are planned for October 21, 2026, at 14:00 UTC.
• The vendor stated fixes might be released earlier if technical details or exploitation evidence appear.

Who is affected

According to public reporting, all PHP versions from PHP 5 onwards are affected by these vulnerabilities. The flaws are collectively referred to as PHP2Shell, suggesting that attackers can use them to obtain command shells on vulnerable servers. One report indicates that CVE-2026-109618 is a use-after-free bug, though specific root causes and attack paths remain undisclosed. WatchTowr confirmed it could reproduce CVE-2026-109618 but withheld technical details.

Our take on the response

PHP’s decision to warn users ahead of the patch release is a prudent move given the severity. By encouraging preparation now, the project aims to minimize the window of exposure once the fixes are live. However, the leak of details before the scheduled disclosure increases the risk of rapid exploitation. The vendor’s willingness to release patches early if exploitation evidence emerges shows a responsive approach to emerging threats.

Who needs to act first

Teams should prioritize systems with direct internet exposure, such as public-facing web servers, for immediate patching once updates are available. Before applying fixes, ensure you have verified backups of your current environment to allow for quick rollback if compatibility issues arise. Test the patches in a staging environment that mirrors production to catch any application breaks. If immediate patching is not possible, consider restricting access to affected services through network segmentation or web application firewalls to reduce the attack surface until a fix can be deployed.

What to do and how to stay safe: PHP

• Identify all servers and containers running PHP versions 5 or higher within your infrastructure.
• Prepare automated deployment scripts to apply the patches immediately upon release to minimize exposure time.
• Monitor server logs and intrusion detection systems for signs of exploitation attempts or unusual shell activity.
• Verify that your backup procedures are functional and recent before initiating any system updates.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When will the patches for CVE-2026-109618 and CVE-2026-109619 be available?

PHP plans to release the patches on October 21, 2026, at 14:00 UTC, but may release them earlier if exploitation evidence emerges.

Are these vulnerabilities currently being exploited in the wild?

WatchTowr and Huntress have not seen evidence of exploitation in the wild, though Sansec predicts mass exploitation may begin shortly after patch release.

Which PHP versions are affected by the PHP2Shell vulnerabilities?

According to public reporting, all PHP versions from PHP 5 onwards are affected by these critical flaws.