Alert! PHP preparing to address pair of Critical RCE vulnerabilities

The PHP security team warned users of an upcoming Critical PHP Security Release in a brief post on October 20 regarding “two critical vulnerabilities, both rated CVSS v4.0 9.2”.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” PHP said .

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

The advisory added that full details, which versions are impacted, and which versions were fixed would be published alongside the release; however, it appears details have already leaked – and the vulnerabilities look serious.

PVP had already said both vulnerabilities featured CVSS scores of 9.2, which is bad enough. They are both, however, also remote code execution vulnerabilities and, according to cyber security firm watchTowr, very real and very worrying.

“Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619,” the company said in an overnight post to X .

“We cannot further information right now. Take this seriously and apply patches when available.”

Benjamin Harris, the company’s CEO, shared information on the developments with Cyber Daily.

"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET,” Harris said overnight. “While we are not able to technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real.”

However, while PHP had originally said the vulnerabilities were less than a perfect 10, watchTowr has said that is exactly what they are, and that they impact PHP versions 5, 6, 7, and 8. “Patches are currently unavailable, but we anticipate that the patch release will now be significantly faster and swifter than the Thursday at 11 am that was previously scheduled,” Harris added.

watchTowr said it has already successfully reproduced CVE-2026-109618; the company added it “will wait for the patches from PHP before sharing any further information”.

PHP is an open-source scripting language designed primarily for web development.

David Hollingworth has been writing technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk Lego.