Skip to content
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Prompt Emergency Patching

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Prompt Emergency Patching

First seen 20 Oct 2026, 20:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 09:46 UTC
  • •Two critical RCE vulnerabilities in PHP set for emergency patch release on October 21, 2026.
  • •CVE-2026-109618 and CVE-2026-109619 are rated 9.2 on the CVSS v4.0 scale, affecting PHP versions from 5 onward.
  • •Mass exploitation is anticipated shortly after the patch release, with organizations advised to prepare for immediate updates.

On October 21, 2026, the PHP security team is set to release emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. These vulnerabilities, identified as remote code execution (RCE) flaws, could allow attackers to execute arbitrary code on servers running PHP, affecting all versions from PHP 5 onward. The vulnerabilities were leaked on October 20, prompting the PHP team to expedite the release originally scheduled for October 22. Security firms, including watchTowr, confirmed the existence of the flaws and warned of potential mass exploitation following the patch release. Organizations are urged to prepare for immediate updates, with some cybersecurity experts predicting attacks could commence within minutes of the patch becoming available. As of now, no active exploitation has been reported in the wild.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-06-07
Public exploit for CVE-2024-4577 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-09-07
CVE-2026-75650 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-13
CVE-2026-103849 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-15
CVE-2026-102764 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
Vulnerabilities leaked online
Details of two critical PHP vulnerabilities were leaked ahead of their scheduled disclosure, prompting an emergency response from the PHP security team.
Huntress
2026-10-21
Emergency patch release scheduled
PHP security team announced an emergency patch for two critical vulnerabilities, scheduled for 14:00 UTC.
Indiatoday
2026-10-21
Mass exploitation expected
Security experts predict mass exploitation of the vulnerabilities could begin within 15 minutes of the patch release.
Sansec
2026-10-21
Public exploit for CVE-2026-109618 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub

More articles in this cluster (44)

Following this threat?

Track CVE-2024-4577 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (29)

1 / 3

Common questions

Which versions of PHP are affected?
All versions from PHP 5 onward are potentially affected, but only supported versions will receive patches.
Is there evidence of exploitation in the wild?
As of now, no active exploitation has been reported, but mass exploitation is anticipated following the patch release.
What should organizations do to prepare?
Organizations should identify all PHP installations and ensure they can apply the patch immediately once it is released.