"Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further ...

X • October 20, 2026

Florian Roth ⚡️ @cyb3rops Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches. 6:46 PM · Oct 20, 2026 · 54.2K Views 13

Florian Roth ⚡️ @cyb3rops 32m more info by PHP php.net/archive/2026.p… CVE-2026-109618 CVE-2026-109619 PHP: News Archive - 2026 From php.net

AJ Stuyvenberg @astuyve 1h ops people leaving the CA private key incident channel and jumping into the PHP incident channel GIF 2

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP Issues Emergency Fixes for Critical RCE Vulnerabilities The PHP security team announced emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, scheduled for release on October 21, 2026. These vulnerabilities affect PHP versions 5 through 8 and are rated 9.2 under CVSS v4.0. Information regarding the vulnerabilities leaked ahead of the planned disclosure, prompting PHP to expedite the release. Security researchers from watchTowr confirmed the existence of the vulnerabilities but noted that no active exploitation has been observed in the wild. Administrators are urged to prepare for immediate updates upon release. The vulnerabilities were initially set for disclosure on October 22, 2026, but the leak has accelerated the timeline. 10 sources 72

Extracted Entities

"Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further ...

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Domains (1)

Platforms (1)