“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” the PHP security team warned in a bulletin published October 21.
The leak on Hacker News and WatchTowr confirmation
On October 20 a user calling themselves “petecooper” posted on the Hacker News forum and disclosed two CVE identifiers — CVE-2026-109618 and CVE-2026-109619 — that had been slated for coordinated public disclosure with security patches. The post, which was later deleted, claimed the flaws were maximum-severity (CVSS 10.0) remote code execution (RCE) vulnerabilities affecting PHP versions dating back to PHP 5 and asserted that exploiting them could permit server takeover. After the post, WatchTowr confirmed that those two CVEs were scheduled for disclosure and that the PHP security team planned to release patches alongside the public advisory.
PHP security team: scheduled patches and a lower CVSS score
In a security bulletin published October 21 the PHP security team said it was working on patches scheduled for release at 2pm GMT on October 21. The team set a critical severity rating of 9.2 for the vulnerabilities — lower than the 10.0 score claimed in the leaked post — and explicitly signalled it could publish details earlier if the flaws became public or if there was evidence of active exploitation.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCERT‑EU and the NCSC advise immediate preparation
Major cybersecurity authorities issued emergency advisories after the leak. CERT‑EU urged organizations to prepare for immediate patching of affected assets and added that, “Where immediate patching is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix is available.” The U.K.’s National Cyber Security Centre (NCSC) also released emergency guidance warning of the upcoming patches.
Scope: PHP’s footprint and likely affected platforms
The vulnerabilities pose a broad potential impact because PHP remains widely deployed: according to recent W3Techs data cited in the reporting, PHP is used by approximately 69.7% of websites whose server-side programming language is known. That footprint includes many content management systems and platforms such as WordPress, Drupal, Joomla and Magento, as well as a range of e‑commerce sites and web services.
Kevin Beaumont’s inferred fixed versions
Inferring from PHP’s pre-release builds, independent security researcher Kevin Beaumont said on Mastodon that the fixed versions will likely be 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What this means for technologists, enterprises, and adversaries
- Technologists and security teams: Prepare for an immediate patching cycle tied to the PHP team’s 2pm GMT schedule and the advisories from CERT‑EU and the NCSC; where patching cannot be completed quickly, CERT‑EU specifically recommends isolating internet-facing applications from public networks.
- Affected enterprises and procurement leaders: Inventory PHP‑backed assets — including the wide range of CMS, e‑commerce and web services platforms named — and plan deployment windows for the likely fixed versions Kevin Beaumont listed.
- Adversaries and threat actors: The premature disclosure of CVE identifiers and high‑level characteristics can enable attackers to accelerate exploit development, for example through reverse engineering techniques called out in the reporting; that risk is the reason the PHP team said it might release details earlier if public disclosure or active exploitation appears.
The immediate fact is simple and stark: identifiers for two critical PHP RCE flaws were disclosed publicly before scheduled patches were available, prompting emergency advisories and a rapid call to action. The PHP security team set a 2pm GMT patching target on October 21 and a critical (9.2) severity rating, while CERT‑EU and the NCSC urged organizations to prepare to patch or, where necessary, isolate internet‑facing applications until fixes can be applied. Whether the coordinated patch release holds to schedule and whether evidence of active exploitation appears in the wild are the specific next markers to watch.
