%20Affect%20Multiple%20PHP%20Versions-1920x1080.jpg)
Summary:
The PHP security team has warned administrators to prepare for emergency security updates scheduled for October 21, 2026, at 14:00 UTC, to address two critical vulnerabilities, each assigned a CVSS v4.0 score of 9.2. Security firm watchTowr reports that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow remote code execution (RCE) and are believed to affect PHP versions 5, 6, 7 and 8. The firm also reports successfully reproducing CVE-2026-109618.
Information about the vulnerabilities was reportedly leaked ahead of the planned disclosure, prompting the PHP security team to reserve the option of releasing patches earlier. At the time of the original report, technical details, confirmed affected versions, and fixed releases had not been officially published. watchTowr had not observed exploitation in the wild.
Technical Description:
CVE-2026-109618 and CVE-2026-109619 are critical remote code execution vulnerabilities reported in PHP, a widely used scripting language that powers websites and web applications, including content management systems, e-commerce platforms and custom web services.
On October 20, 2026, the PHP security team announced plans for an out-of-band security release and assigned each vulnerability a CVSS v4.0 score of 9.2. However, watchTowr and a subsequently deleted Hacker News post described both vulnerabilities as having a CVSS score of 10.0, differing from PHP's reported official assessment.
At the time of the announcement, PHP had not disclosed the vulnerable components, exploitation methods, confirmed affected versions or fixed releases. These details were expected to accompany the security update. According to watchTowr, the vulnerabilities were believed to affect PHP versions 5, 6, 7 and 8. The firm reported successfully reproducing CVE-2026-109618 but withheld technical details pending the availability of patches.
The disclosure timeline was affected by an information leak. watchTowr stated that the vulnerabilities were originally embargoed until Thursday at 11:00 AM Eastern Time, while PHP scheduled its security release for Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern Time). PHP also indicated that the release could be accelerated if further technical details became public or exploitation was detected.
Organisations should treat the vulnerabilities as a high-priority patching concern and verify the confirmed affected versions and available fixes through official PHP security announcements.
| CVE | CVSS | Vulnerability Type | Affected Product | Patch Version |
| CVE-2026-109618 | 9.2 (Critical) | Remote Code Execution (RCE) | PHP | Pending |
| CVE-2026-109619 | 9.2 (Critical) | Remote Code Execution (RCE) | PHP | Pending |
Exploitation Demonstration:
- An attacker identifies an internet-facing server or application running a potentially affected PHP version, reportedly within PHP versions 5, 6, 7 or 8.
- The attacker submits crafted input or requests intended to trigger a vulnerability. The specific trigger and affected component have not been disclosed.
- Successful exploitation could allow arbitrary code execution on the server, potentially with the privileges of the PHP runtime or web server process.
- watchTowr reports successfully reproducing CVE-2026-109618 but is withholding technical details until patches become available.
- Following successful code execution, an attacker could potentially deploy web shells, access application data or credentials, modify website content or establish persistent access.
Ease of Exploitation:
The ease of exploitation cannot be conclusively assessed because PHP had not published the attack vector, required privileges, user interaction requirements or technical exploitation details at the time of the original report.
Nevertheless, the reported CVSS v4.0 score of 9.2, watchTowr's assessment of 10.0 and its successful reproduction of CVE-2026-109618 indicate potentially severe security implications.
The premature disclosure and PHP's widespread deployment could accelerate vulnerability scanning and exploit development once technical details become publicly available. According to the supplied report, no exploitation in the wild had been observed at that time.
Conclusion:
CVE-2026-109618 and CVE-2026-109619 represent a significant potential security risk to organisations operating PHP-based websites and applications due to their reported remote code execution impact, the potentially broad range of affected versions and the premature disclosure of vulnerability information.
Although exploitation had not been observed at the time of the original report, the interval between public disclosure and exploitation attempts can be limited.
Organisations should identify PHP deployments, prioritise internet-facing systems, verify official security updates and apply the appropriate fixed releases promptly. Security teams should also monitor affected environments for suspicious activity.
Impact:
Successful exploitation could allow attackers to execute arbitrary code on vulnerable PHP servers, potentially resulting in compromised web applications and underlying hosts, deployment of web shells, theft of sensitive data and credentials, unauthorised website modifications and persistent access.
Given PHP's widespread use across content management systems, e-commerce platforms and custom web applications, potentially affected internet-facing environments could face significant exposure once exploitation details become available.
IOC and Context Details:
| Topics | Details |
| Tactic Name | Initial Access, Execution |
| Technique Name | Exploit Public-Facing Application |
| Sub Technique Name | NA |
| Attack Type | Vulnerability |
| Targeted Applications | PHP (versions 5, 6, 7, and 8 reportedly affected) and PHP-based web applications |
| Region Impacted | Global |
| Industry Impacted | All industries operating PHP-based websites and web applications |
| IOC's | NA |
| CVE | CVE-2026-109618, CVE-2026-109619 |
Recommended Actions:
· Prepare for emergency patching and monitor php.net and PHP security announcements for the release scheduled for October 21, 2026 at 14:00 UTC; apply the fixed versions immediately once available.
· Inventory all PHP deployments, including web servers, containers, CMS and e-commerce platforms, and hosted environments, prioritizing internet-facing systems and legacy or end-of-life versions that may not receive fixes.
· Coordinate with hosting providers, vendors, and OS or package maintainers to confirm the availability of patched PHP packages and bundled runtimes.
· Until patches are applied, limit exposure of PHP applications through WAF rules, reverse proxies, and network ACLs, and deploy vendor or WAF signatures as soon as they are published.
· Review web server and application logs for anomalous requests, unexpected PHP errors or crashes, and unusual child processes spawned by PHP or web server processes.
· Monitor web roots and upload directories for web shells and unauthorized file changes, and restrict PHP execution in upload and temporary directories wherever feasible.
· Run PHP with least privilege, isolate web workloads through containers or segmentation, and restrict unnecessary outbound connections from web servers.
· After patching, validate the deployed PHP versions across all environments; if compromise is suspected, preserve logs, contain affected systems, rotate exposed credentials, and conduct a thorough assessment.