PHP development team plans to release updates tomorrow to address two vulnerabilities, each rated 9.2; security researchers at watchTowr say they are RCE flaws
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities …
BleepingComputerLawrence Abrams
Context & Ripple Effects
PHP's warning follows a long-running sensitivity around remote-code-execution remediation: in 2012, researchers said an official PHP fix could be bypassed. The advance notice also comes after watchTowr publicly said an embargoed disclosure had leaked, adding operational urgency before the scheduled release.
The incident fits a wider 2026 pattern of critical server-software RCE response, including Citrix's disclosure of exploited NetScaler RCE flaws. The relevant question for PHP operators is not only the severity rating, but which deployed runtimes and applications can receive and absorb the update.
First-order effects
PHP administrators need to schedule deployment of the October 21 security updates and prioritize systems exposed to PHP workloads, after watchTowr characterized the two flaws as RCE issues.
The leaked-disclosure discussion shortens the period in which organizations can quietly prepare, making asset inventory and change-control readiness immediate concerns.
Second-order effects
Organizations running older PHP branches must establish whether the release covers their deployments; public discussion specifically raised concerns about PHP 7.x installations, without establishing their exposure.
Teams responsible for PHP-dependent applications will need to test and roll out the fixes faster than normal maintenance cycles, increasing pressure on hosting and application operations groups.
Third-order effects
The earlier bypassable PHP remediation underscores that critical-RCE response is becoming a question of patch quality and verification, not merely whether a vendor ships an update.
If advance warnings and leaked embargoes recur, security teams will increasingly treat runtime inventory and preplanned emergency maintenance as core controls for widely deployed server software.
The trend: Critical server-software vulnerabilities are pushing security operations toward preplanned emergency patching, with remediation validation as important as severity scoring.
Since I heard about this #PHP #RCE last week, I've been preparing a tool for everyone who doesn't know what to do right now: process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity Until a patch is out, isolat…
We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619 We cannot share further information right now. Take this seriously and apply patches when available.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
if this affects the default installation of PHP We are fucked up CVE-2026-109618 CVE-2026-109619 PHP RCEs with a CVSS score of 10.0 ☠️ https://news.ycombinator.com/ ...
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
Marked safe from phpocalypse because you've been running php 5.1 since 2005 and it's not affected (?) (there is prob a two digit percentage of companies like this)
Critical PHP vulnerabilities to be disclosed tomorrow: https://www.php.net/.... We're working directly with the PHP Foundation to get patched PHP versions into our base images for Laravel Cloud, Forge, and Vapor ASAP. You may need to redeploy your apps at that time to use these p…
My concern with the upcoming PHP RCE disclosure is how many systems could remain exposed long after patches become available. Roughly a third of PHP websites still run PHP 5 or 7. Some operators will need to migrate old applications before they can move to a supported release. Ev…
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* cons…