Skip to content
Critical RCE Vulnerabilities in PHP Confirmed, Patches Coming Soon

Critical RCE Vulnerabilities in PHP Confirmed, Patches Coming Soon

First seen 20 Oct 2026, 20:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 22:21 UTC
  • •Two critical RCE vulnerabilities in PHP confirmed with CVSS 9.2 rating.
  • •Patches will be available for PHP 8.0 and above, with release expected on October 21.
  • •Exploitation is anticipated soon after details are disclosed.

PHP's security team confirmed two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 officially, with some reports indicating a CVSS of 10.0. The vulnerabilities affect PHP versions 5 through 8, but only PHP 8.0 and above will receive patches. The announcement followed a leak that broke an embargo, prompting immediate attention from the security community. The PHP Foundation plans to release patches on October 21, 2026, and may release them earlier if exploitation is observed. Security experts anticipate that exploitation attempts will occur shortly after details are made public. PHP is widely used in major platforms like WordPress and Wikipedia, making these vulnerabilities particularly concerning for many web applications.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Critical RCE vulnerabilities confirmed
PHP's security team confirmed two critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP versions 5 and above.
AGTP
2026-10-20
Details leaked before official announcement
A leak broke the embargo on the vulnerabilities, prompting immediate discussions in the security community.
News.Ycombinator
2026-10-21
Patch release scheduled
The PHP Foundation plans to release patches for the vulnerabilities, specifically for PHP 8.0 and above.
AGTP

More articles in this cluster (5)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 2

Common questions

Which PHP versions are affected?
The vulnerabilities affect PHP versions 5, 6, 7, and 8, but only PHP 8.0 and above will receive patches.
When will the patches be released?
Patches are scheduled for release on October 21, 2026, with a possibility of an earlier release if necessary.
What should I do to protect my systems?
PHP administrators should inventory their hosts and prepare to update as soon as the patches are available.