The PHP security team has told administrators to get ready for an emergency security release on Wednesday, October 21, 2026 at 14:00 UTC. It will fix two critical vulnerabilities that the team rates 9.2 on the CVSS v4.0 scale. PHP says it reserves the right to release earlier “should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” and that the affected versions, fixed versions and technical details will only be published with the release.
According to BleepingComputer, information about the flaws appeared to leak before the planned disclosure. Researchers at watchTowr said the two bugs are real, are tracked as CVE-2026-109618 and CVE-2026-109619, and are remote code execution (RCE) flaws that they believe affect PHP versions 5, 6, 7 and 8. watchTowr said it has reproduced CVE-2026-109618, is holding back technical details until patches exist, and has not seen exploitation in the wild. Some of watchTowr’s claims differ from PHP’s own announcement: it described both flaws as CVSS 10.0 (PHP says 9.2) and cited a Thursday disclosure date (PHP says Wednesday). Treat PHP’s announcement as authoritative and watchTowr’s version range as unconfirmed until the release notes are out.
How to check if you’re affected
Affected versions have not been published by PHP yet, so there is nothing to match against today. What you can do now is find where PHP runs in your environment: web servers and containers running PHP-FPM or mod_php, content management systems such as WordPress, Drupal or Joomla, shared-hosting accounts, and internal tools. Note each PHP version in use (php -v, or the version shown by your hosting panel).
On October 21 at 14:00 UTC, read the PHP release announcement for the affected and fixed versions, then update PHP or the base image or distribution package that provides it. If you rely on a hosting provider, ask when they will deploy the fix. Because PHP may release early, check php.net for updates before that time.