AGTP on X: "PHP's security team just confirmed two critical RCE flaws after a leak. Here's ...

PHP's security team just confirmed two critical RCE flaws after a leak. Here's what you need to know.

Security researcher Florian Roth posted that there is an RCE vulnerability in PHP core, rated CVSS 10.0. He said details were due October 20 and that only PHP 8 would get patches. The post drew 53K views. The story spread after a leak broke the embargo, which watchTowr had expected to hold until Thursday at 11am ET.

The PHP Foundation then gave official advance notice. The security release is set for Wednesday, October 21, 2026 at

UTC, which is 10 AM EDT. It fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The official rating is CVSS v4.0 9.2, not the 10.0 circulating online. The team says it may release earlier if details become public or active exploitation shows up. Some posts quoted 9 AM EDT, and watchTowr's post misprinted the CVE year as 2926.

The leak is confirmed as real. watchTowr says the embargoed zero-days are real, and Previdian says it reproduced them. No technical details are public. Reports say the flaws touch PHP 5, 6, 7 and 8, but only 8.0 and up are expected to get fixes. That is unconfirmed. Researcher Nicolas Krassas plans to publish a lab on the bugs when the embargo lifts. Security commentators expect exploitation within minutes of the details dropping.

PHP runs Wikipedia, WordPress sites, WooCommerce stores, Drupal sites and Adobe Commerce storefronts.

- CVSS v4.0 9.2 officially, 10.0 in leaked reports

PHP admins should inventory their hosts now and update as soon as the release lands.

Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.

look this up for all our projects and watch for similar things on our whole software stack from now on regularly