PHP to ship emergency fixes for two 9.2 flaws on Wednesday
PHP will publish patched versions and full details on October 21 after two critical vulnerabilities were disclosed.
PHP’s security team says it will ship emergency fixes on Wednesday, October 21 at 14:00 UTC for two newly disclosed vulnerabilities, both rated 9.2 under CVSS v4.0. The company has not yet said which PHP releases are affected or how the bugs work, but it plans to publish full technical details and patched versions when the update lands. Security researchers at watchTowr say the issues are remote code execution bugs tracked as CVE-2026-109618 and CVE-2026-109619, and that they appear to affect PHP 5 through 8. watchTowr also says the flaws were leaked ahead of the intended embargo, though it has not seen active exploitation in the wild.
Why it matters
For teams running PHP, the immediate change is that two high-severity bugs now have a fixed date for remediation, even though PHP has not yet said which releases are affected. watchTowr’s report points to remote code execution and a broad range of versions, so administrators will need to watch the update closely and assess exposure as soon as the patches land.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BleepingComputer