Vulnerabilities · 2h ago
CERT-EU says the PHP Foundation announced on Oct. 20 that a security release for two critical PHP flaws is scheduled for Oct. 21 at 14:00 UTC. The flaws, CVE-2026-109618 and CVE-2026-109619, reportedly affect PHP 5 and later, but no technical details or fixed versions are public.
Leaked information and the flaws’ CVSS scores point to possible unauthenticated remote code execution (RCE): running code on a server without first logging in. The actual flaw paths remain undisclosed, so neither the attack method nor the exact vulnerable builds can yet be confirmed.
If an organization has internet-facing PHP apps missing from its inventory—especially legacy PHP 5 deployments—it may not know which systems are in scope when fixes arrive. Until PHP publishes the release details, the breadth of exposure remains reported rather than verified.
6 sources covering this story
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP2Shell involves two critical PHP RCE flaws rated CVSS 9.2, with emergency fixes scheduled following a disclosure leak.
A critical PHP security release is coming today, so get ready to update! - Help Net Security
A critical PHP security release is due 21 October at 14:00 UTC, fixing two CVSS 9.2 flaws. Here’s what site owners should do to prepare now.
PHP warns it plans to release 2 emergency patches imminently
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
PHP Announces Critical Security Release for Two Vulnerabilities | Qualys
On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for October 21, 2026…
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
Part of the PlainSec briefing for 2026-10-21