Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming

News.Ycombinator • October 20, 2026

I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority. These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards. These are the two reserved CVEs for the reported upcoming announcement: CVE-2026-109618 CVE-2026-109619

These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards. These are the two reserved CVEs for the reported upcoming announcement: CVE-2026-109618 CVE-2026-109619

These are the two reserved CVEs for the reported upcoming announcement: CVE-2026-109618 CVE-2026-109619

CVE-2026-109618 CVE-2026-109619

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP Issues Emergency Fixes for Critical RCE Vulnerabilities The PHP security team announced emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, scheduled for release on October 21, 2026. These vulnerabilities affect PHP versions 5 through 8 and are rated 9.2 under CVSS v4.0. Information regarding the vulnerabilities leaked ahead of the planned disclosure, prompting PHP to expedite the release. Security researchers from watchTowr confirmed the existence of the vulnerabilities but noted that no active exploitation has been observed in the wild. Administrators are urged to prepare for immediate updates upon release. The vulnerabilities were initially set for disclosure on October 22, 2026, but the leak has accelerated the timeline. 10 sources 72

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (2)

CVE-2026-109618 CVE-2026-109619