/
← Voltar ao feed
high

PHP warns of emergency patches for two leaked critical RCE flaws, CVE-2026-109618 and CVE-2026-109619

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 17:56 · coletado há 6 horas

The PHP security team has warned administrators to prepare for emergency security updates on October 21 at 14:00 UTC, fixing two critical vulnerabilities each rated 9.2 under CVSS v4.0. Information about the flaws reportedly leaked ahead of the planned embargo, and the team says it may release earlier if details become public or exploitation appears in the wild. watchTowr told BleepingComputer the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution (RCE) issues believed to affect PHP versions 5, 6, 7 and 8, and that it believes it has reproduced CVE-2026-109618. watchTowr has not observed exploitation in the wild and is withholding technical details until patches are available. The leak followed a now-deleted Hacker News post by user "petecooper" that named both CVE IDs.

Technical Details

  • PHP has not published affected versions, exploitation details or fixed releases; these are due with the security release.
  • watchTowr and the Hacker News post describe both flaws as CVSS 10.0, while PHP's advisory rates each 9.2 (CVSS v4.0).
  • The disclosure date is also inconsistent: watchTowr and the Hacker News post cite October 22 (Thursday), while PHP has scheduled the release for October 21.
  • The affected version range (PHP 5 to 8) comes from watchTowr and is not confirmed by PHP.

Remediation

  • Prepare to deploy the PHP security updates as soon as they are released on October 21 at 14:00 UTC, or earlier if PHP releases ahead of schedule.
  • Inventory internet-facing PHP applications (CMS, e-commerce, custom services) and identify the PHP versions in use.
  • Monitor the PHP ANNOUNCE mailing list and the official advisory for affected versions and fixed releases.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 20/10/2026 17:56 · coletado 20/10 18:00 primeiro registro

    PHP warns of emergency patches for two leaked critical RCE flaws, CVE-2026-109618 and CVE-2026-109619

    ler a análise desta fonte

    The PHP security team has warned administrators to prepare for emergency security updates on October 21 at 14:00 UTC, fixing two critical vulnerabilities each rated 9.2 under CVSS v4.0. Information about the flaws reportedly leaked ahead of the planned embargo, and the team says it may release earlier if details become public or exploitation appears in the wild. watchTowr told BleepingComputer the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution (RCE) issues believed to affect PHP versions 5, 6, 7 and 8, and that it believes it has reproduced CVE-2026-109618. watchTowr has not observed exploitation in the wild and is withholding technical details until patches are available. The leak followed a now-deleted Hacker News post by user "petecooper" that named both CVE IDs.

    Technical Details

    • PHP has not published affected versions, exploitation details or fixed releases; these are due with the security release.
    • watchTowr and the Hacker News post describe both flaws as CVSS 10.0, while PHP's advisory rates each 9.2 (CVSS v4.0).
    • The disclosure date is also inconsistent: watchTowr and the Hacker News post cite October 22 (Thursday), while PHP has scheduled the release for October 21.
    • The affected version range (PHP 5 to 8) comes from watchTowr and is not confirmed by PHP.

    Remediation

    • Prepare to deploy the PHP security updates as soon as they are released on October 21 at 14:00 UTC, or earlier if PHP releases ahead of schedule.
    • Inventory internet-facing PHP applications (CMS, e-commerce, custom services) and identify the PHP versions in use.
    • Monitor the PHP ANNOUNCE mailing list and the official advisory for affected versions and fixed releases.