"We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the PHP security team warned.
The PHP security team's advisory and the scheduled emergency release
The PHP security team on Tuesday told administrators to prepare for emergency security updates scheduled for Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern). The advisory, and a notice sent to the project's ANNOUNCE mailing list, urges administrators to be ready to install the updates as soon as they become available. The team said it will publish full technical details, affected versions, and fixed releases only when those security updates are released.
What is — and is not — being disclosed about the flaws
The developers have not disclosed technical details: the advisory lists no affected versions, no exploitation vector, and no candidate fixed releases. The PHP team assigned each vulnerability a CVSS v4.0 score of 9.2. Beyond that administrative framing, outside researchers have offered additional, divergent claims.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogwatchTowr's claims and the CVE identifiers
Security researchers at watchTowr told BleepingComputer that the two flaws are remote code execution (RCE) vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. In remarks to BleepingComputer, watchTowr CEO Benjamin Harris said, "In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET." The researchers told BleepingComputer they believe the vulnerabilities affect PHP versions 5, 6, 7, and 8.
watchTowr further stated, "While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8." The group said it believes it has successfully reproduced CVE-2026-109618 but is withholding technical details until security patches are available. WatchTowr also noted that it has not observed exploitation of the vulnerabilities in the wild.
Those characterizations differ from the PHP security team's public scoring: watchTowr and an early online post described the flaws as CVSS 10.0, while PHP has given each a 9.2 score under CVSS v4.0.
Public leak signals: Hacker News and social posts
BleepingComputer reviewed a now-deleted post on Y Combinator's Hacker News forum by a user named "petecooper" that identified the same CVE identifiers and stated the vulnerabilities carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5. watchTowr also posted on X, warning that "Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real" and adding that participants "were all supposed to wait until Thursday at 11am ET." Those public signals appear to have prompted PHP's explicit caveat that it may release fixes earlier if details leak or active exploitation is detected.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams: The PHP security team's scheduled release time and the advisory to prepare to install updates place the immediate task on web administrators and operations teams to have update processes and rollback plans ready. The absence of public technical details means teams must wait for vendor-fixed releases and accompanying advisories before determining which systems to patch.
- Affected enterprises and procurement leaders: Organizations that run PHP-based websites, content management systems, e-commerce platforms, or custom web services will need to inventory exposed PHP versions rapidly once PHP publishes the affected releases and fixes. The differing public severity assessments (9.2 versus reported 10.0) underscore that enterprises will need to reconcile vendor advisories with outside research as they prioritize patches.
- Adversaries and threat actors: Both the PHP team's warning that it may accelerate a release and watchTowr's statements that some reproduction has occurred indicate heightened attention in public forums. The PHP team explicitly said it could move earlier "should evidence of active exploitation appear in the wild," a signal that any observed exploitation would likely change disclosure tempo and urgency.
Conclusion: fixed releases incoming, questions remain
PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services. With emergency updates scheduled for Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), administrators have a clear calendar target but limited technical information until the fixes ship. The PHP security team has promised full technical details and fixed releases at that time and reserves the right to act sooner if the leak or exploitation accelerates events. For now, the community waits for the vendor's patches and the accompanying technical advisories, and administrators should be prepared to apply those updates immediately when they appear.
