Technology and Scienceupdated 1h ago2 min read
PHP Security Maintainers Plan Emergency Patches for CVE-2026-109618 and CVE-2026-109619
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Two critical PHP vulnerabilities rated 9.2 CVSS v4.0; emergency patches planned Patches scheduled for October 21, 2026 at 14:00 UTC; admins urged to prepare
PHP patches after leak
PHP security maintainers said they planned to release emergency patches for two vulnerabilities in a little more than 12 hours, with both flaws rated 9.2 out of 10 under CVSS v4.0. PHP maintainers scheduled the security release for Wednesday, October 21, 2026, at 14:00 UTC, and they urged administrators to prepare so they could upgrade as soon as the release is available.
PHP maintainers said they reserved the right to release earlier if details of either vulnerability became public or if evidence of active exploitation appeared in the wild. watchTowr said it claimed the vulnerabilities affect every PHP version from PHP 5, released in 2004, onward, and it said it confirmed the vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 are real.
What is known, what is not
PHP said its advance notice would publish full technical details, affected versions, and fixed releases alongside the patches, but it did not name the CVEs or explain how the flaws work in the advance warning. CERT-EU’s advisory referenced both identifiers and warned of possible remote code execution without authentication, while the PHP advance notice did not confirm broad claims about default installations being vulnerable.
watchTowr told BleepingComputer that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution flaws believed to affect PHP versions 5, 6, 7, and 8. watchTowr also said it had not observed exploitation in the wild at the time of its assessment, even as it warned that information had leaked before the originally planned disclosure date.
After patch day
PHP maintainers said they would publish the technical details, affected versions, and corrected releases alongside the security update scheduled for October 21 at 14:00 UTC, and they said administrators should check the official affected-version list when it arrives.
“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”
Laravel News said the PHP and Node.js teams have both announced security releases for Wednesday, October 21, and it said the Laravel team announced both Forge and Cloud would be updated with a fix to a second node.js security issue.
Laravel News quoted the Laravel team saying it was working directly with the PHP Foundation to get patched versions into its base images as quickly as possible, and it said users may need to redeploy apps to pick up the patched images.
watchTowr warned that information about the vulnerabilities had leaked before the originally planned disclosure date, and it said, "We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP."