Key points
- Two remote code execution flaws in PHP are rated 9.2 severity and affect versions 5 through 8.
- Details leaked before the scheduled October 21 disclosure, prompting an early patch warning.
- watchTowr confirmed the flaws are real but has not seen active exploitation in the wild.
Administrators face an urgent need to prepare for emergency updates to the PHP scripting language after details of two severe vulnerabilities leaked prematurely. The PHP security team warned that updates addressing these flaws, which allow remote code execution, are scheduled for release on Wednesday, 21 October, at 14:00 UTC. The team stated they may release patches earlier if evidence of active exploitation emerges or if further details become public.
In plain English
Remote code execution flaws allow attackers to run arbitrary commands on a server from a distance. In this case, the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and are believed to affect PHP versions 5, 6, 7, and 8. This means any website or service running affected PHP versions is potentially exposed. The severity rating of 9.2 out of 10 indicates the flaws are considered critical by the PHP development team.
View the original post on X
The background
Security researchers at watchTowr confirmed the existence of the two flaws, telling BleepingComputer that they believe the issues affect PHP versions 5, 6, 7, and 8. An unconfirmed report circulated a video of a tool called PHP2Shell allegedly exploiting these flaws on various platforms, including WordPress, Magento, and Drupal. However, watchTowr clarified that they have not observed actual exploitation in the wild despite the leaked information.
What changes now
The PHP maintainers published an advisory on Tuesday urging all users to prepare to install updates as soon as they become available. They reserved the right to release the patches earlier if details become public or if evidence of active exploitation appears. Security firms including Sansec, Webfence, and Huntress have issued their own advisories, with Sansec researchers predicting mass attacks could begin shortly after the patches are released.
The attacker's path
Teams usually assess exposure by identifying which servers run vulnerable language versions before patches are available. In this scenario, the weakness lies in the interpreter, meaning the attack surface is broad. Attackers typically seek unpatched instances to establish initial access, often using automated scanning to find targets. Once inside, they can execute commands to steal data or deploy further malware. Monitoring for unusual outbound connections helps detect such early-stage compromises.
What to do and how to stay safe: PHP
- Identify all systems running PHP versions 5 through 8 and determine responsibility for their maintenance.
- Prepare a maintenance window starting at 14:00 UTC on 21 October, with contingency plans for earlier release.
- Create backups of site and database files before applying any updates to ensure recovery options exist.
- Monitor the PHP.net homepage for announcements regarding earlier release times or active exploitation evidence.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by these vulnerabilities?
watchTowr believes the flaws affect PHP versions 5, 6, 7, and 8, though the PHP team has not officially disclosed specific affected versions.
Are these vulnerabilities currently being exploited in the wild?
watchTowr stated that they have not observed exploitation of the vulnerabilities in the wild, despite the leak of technical details.
When are the emergency patches scheduled to be released?
The PHP security team plans to release updates on Wednesday, 21 October, at 14:00 UTC, but may release them earlier if necessary.
