PHP Core RCEs CVE-2026-109618 and CVE-2026-109619 Leak Early

On October 20, 2026, details of two previously embargoed remote code execution vulnerabilities in PHP core began circulating publicly, prompting an accelerated response from the PHP security team. The issues, tracked as CVE-2026-109618 and CVE-2026-109619 , were confirmed as real by the cybersecurity firm watchTowr after information leaked ahead of a planned coordinated disclosure.

The first public mention appeared in a now-removed "Tell HN" post on Hacker News (item 50167754). User petecooper cited a "reliable source" claiming an announcement covering two PHP RCEs with a CVSS score of 10.0 was scheduled for October 22, 2026, at 18:00 CEST. Screenshots and summaries of the post spread quickly on X and Mastodon. A related X post by @collysucker amplified the claim, noting that the vulnerabilities reportedly affect all PHP versions from PHP 5 onward and identifying the reserved CVE IDs.

Later the same day, watchTowr (@watchtowrcyber) published a statement acknowledging the leak:

"We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619. We cannot further information right now. Take this seriously and apply patches when available."

"We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619. We cannot further information right now. Take this seriously and apply patches when available."

The company clarified the correct CVE numbers and stated that it did not discover the vulnerabilities, leaving credit for the original researchers. Accompanying the post was a "Rapid Reaction" graphic highlighting CVE-2026-109618.

Official PHP Response

In response to the premature disclosure, the PHP security team published an advance notice on php.net (archive entry dated October 20, 2026):

"The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."

"The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."

This moves the release earlier than the originally rumored Thursday window. Full technical details, affected version ranges, and fixed versions will be published with the release itself. As of this writing, both CVEs remain in reserved status with no public descriptions.

What Is Known (and What Is Not)

Security practitioner Nicolas Krassas (@Dinosn) has indicated he will release a technical lab once the embargo lifts. Other posts on X have urged organizations to inventory PHP hosts and prepare upgrade plans.

Organizations running PHP should:

Inventory all instances, noting the major version (5.x, 7.x, or 8.x) and deployment method (OS packages, containers, custom builds, shared hosting).

Prioritize migration of any remaining PHP 5 or PHP 7 systems to a supported PHP 8 branch, as those older versions will not receive patches.

Monitor php.net, vendor security channels, and Linux distribution advisories for the October 21 release and apply updates promptly once available.

Review exposure of internet-facing PHP applications, particularly those using default or minimally hardened configurations.

Because technical details remain unpublished, specific detection or mitigation guidance beyond upgrading is not yet possible. The PHP team's decision to advance the release timeline after the leak underscores the risk of further information becoming public before patches are widely available.

php.net news archive (20 Oct 2026)

watchTowr X post and thread

Original HN tip as relayed on X

Statements from Florian Roth and other researchers

Track breaking advisories before and after embargo with the Threat Landscape Platform — structured intelligence, IoC feeds, and an AI Assistant for instant context. Start free, no credit card required.