PHP Patches Two Critical Vulnerabilities, CVE-2024-XXXX and CVE-2024-XXXX

Key Takeaways

• The PHP security team has announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2.
• These flaws are widely reported to be remote code execution vulnerabilities, potentially allowing unauthorized code execution on affected servers.
• Official patches are scheduled for release on Wednesday, October 21, 2026, at 14:00 UTC.
• Users are urged to prepare for immediate patching, as the vulnerabilities could affect a broad range of PHP versions.

Critical PHP Vulnerabilities Demand Urgent Patching

The PHP security team has issued a critical alert regarding two severe vulnerabilities, urging system administrators to prepare for an imminent security update. Both identified flaws carry a CVSS v4.0 severity rating of 9.2, underscoring their potential impact. The official patch release is slated for Wednesday, October 21, 2026, at 14:00 UTC, providing a narrow window for website owners and hosting providers to ready their systems.

In its official security notice, published on October 20, PHP confirmed its intent to release comprehensive technical details, a list of affected versions, and the corresponding fixed releases concurrently with the patches. The team also stated that the update schedule could be accelerated if either vulnerability becomes publicly known or if evidence of active exploitation emerges.

Unconfirmed Details and Potential Scope

While PHP’s advance notification did not explicitly name the vulnerabilities or detail their mechanics, external reports widely link the forthcoming fixes to CVE-2026-109618 and CVE-2026-109619. The security firm watchTowr has characterized these as reported remote code execution (RCE) vulnerabilities, which, if exploited, could enable attackers to execute arbitrary code on vulnerable servers.

Further corroborating these claims, CERT-EU’s advisory also references both CVE identifiers, cautioning about potential unauthenticated remote code execution. This assessment, however, is partly based on leaked information, making it crucial for administrators to distinguish between confirmed facts from PHP and details circulating from other sources.

Initial discussions suggest that PHP versions from PHP 5 onwards could be impacted, though the vendor has not yet confirmed the full breadth of affected versions. PHP has also not specified whether default installations are vulnerable, which configurations might be at risk, or if certain operating systems face heightened exposure.

Although some early reports indicated a maximum severity score of 10.0, PHP’s official CVSS v4.0 rating for each vulnerability is 9.2. This official score should be the guiding metric for assessing risk until more detailed information on the attack conditions and underlying vulnerabilities is released.

No Confirmed Exploitation, But Preparation is Key

As of watchTowr’s update, there has been no confirmed exploitation of these vulnerabilities in the wild. PHP’s warning about a potential early release serves as a precautionary measure, not an indication of active attacks. Claims of leaked demonstrations or exploit code should not be construed as evidence of successful attacks against live targets.

Historical incidents underscore the urgency of rapid preparation. For instance, CVE-2024-4577, a separate PHP flaw, saw active exploitation attempts within 24 hours of its disclosure. While this context highlights the importance of timely patch planning, it does not confirm exploitation of these newly disclosed vulnerabilities.

It is also important to note that these new vulnerabilities are distinct from earlier PHP SOAP extension vulnerabilities addressed in 2026. Administrators should not assume that patches applied for previous PHP flaws will mitigate the two issues covered by this upcoming release.

What You Should Do

• Identify PHP Applications: Locate all PHP installations within your environment and understand their update mechanisms.
• Prepare for Patching: Be ready to apply the official fixes immediately upon their release on October 21, 2026, at 14:00 UTC.
• Verify Updates: After applying patches, confirm that the correct fixed versions of PHP are running on your systems.
• Consider Isolation: If immediate patching is not feasible for internet-facing applications, consider temporarily isolating them from public networks. Balance this decision with service availability and business requirements.
• Stay Informed: Monitor PHP’s official channels for the definitive list of affected versions and technical details, and do not rely solely on unconfirmed reports.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.