The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services.
In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0.
The PHP security team also sent a notice to its ANNOUNCE mailing list, urging administrators to prepare to install the security updates as soon as they become available.
“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” the PHP security team warned.
The developers have not disclosed any technical details about the vulnerabilities, including which PHP versions are affected, how they can be exploited, or which releases will contain fixes.
However, security researchers at watchTowr told BleepingComputer that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution (RCE) flaws believed to affect PHP versions 5, 6, 7, and 8.
“In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET,” watchTowr CEO Benjamin Harris told BleepingComputer.
“While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8.”
watchTowr also said it believes it has successfully reproduced CVE-2026-109618 but is not releasing technical information until security patches become available.
The researchers clarified that they have not observed exploitation of the vulnerabilities in the wild, despite the information reportedly leaking ahead of the planned disclosure.
In a post on X, watchTowr warned that information about the vulnerabilities had leaked before the originally planned disclosure date.
“We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they’re real,” the researchers said.
The warning follows a now-deleted post on Y Combinator’s Hacker News forum, in which a user named “petecooper” claimed that two critical PHP remote code execution vulnerabilities would be disclosed on October 22.
The post, seen by BleepingComputer, claimed that both vulnerabilities carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5.
It also identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, matching the identifiers watchTowr later shared.
However, watchTowr’s statements and the Hacker News post are different from PHP’s official announcement. Both described the vulnerabilities as CVSS 10.0, while the PHP security team assigned each a CVSS v4.0 score of 9.2.
Additionally, watchTowr cited an originally planned Thursday disclosure, while PHP has officially scheduled its security release for tomorrow morning.
The PHP security team says it will publish full technical details, affected versions, and fixed releases when the security updates become available.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
