PHP warned administrators to get ready for emergency security updates after information about two critical flaws reportedly leaked before planned disclosure. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619 and are described as remote code execution flaws, meaning an attacker may be able to run malicious code from afar. PHP says patches are due October 21, 2026, and fuller details on affected versions and fixed releases will follow then; outside researchers said the issues may affect PHP 5 through 8, but PHP had not yet confirmed version scope in the advisory.
Why it matters: PHP runs a huge share of websites and web applications, so even a short gap between leaked details and available patches can create broad internet risk. Organizations that use PHP should prepare to patch immediately when updates land and closely watch for vendor guidance or signs of active exploitation.
Lawrence Abrams
2026.10.20
100% relevant
This article establishes the story by documenting PHP's own emergency warning and the concrete identifiers, CVE-2026-109618 and CVE-2026-109619, before patches are released.
← Back to all stories