GoKawiilPHP team to release emergency patches for two critical RCE flaws after leak
The PHP security team announced it will ship fixes on Wednesday, October 21 at 14:00 UTC for two vulnerabilities each rated 9.2 on CVSS v4.0, after details reportedly leaked ahead of a planned embargoed disclosure. Researchers at watchTowr say the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs affecting PHP versions 5 through 8, and that watchTowr has reproduced one of them without releasing technical details.
GoKawiil's interpretation of the reporting above, not reported fact.
Because PHP underpins a huge share of websites, CMSs and e-commerce platforms, remote code execution bugs of this severity could expose a very wide swath of the internet if exploit details spread before patches are applied. The early leak raises the risk that attackers move faster than defenders, which is likely why the PHP team says it may release fixes even earlier than planned if active exploitation emerges.
- PHP plans emergency patches Oct 21, 14:00 UTC for two CVSS 9.2 flaws
- CVE-2026-109618 and CVE-2026-109619 reportedly leaked before scheduled disclosure
- watchTowr says the RCE bugs affect PHP versions 5, 6, 7 and 8
Source: bleepingcomputer.com, 2026-10-20
Published there as: “PHP warns admins of two critical flaws, emergency patches coming tomorrow”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.