As reported by BleepingComputer, the PHP security team is preparing emergency patches for two critical remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — after details leaked ahead of a coordinated Thursday disclosure. Patches are scheduled for release on Wednesday, October 21 at 14:00 UTC, though the PHP team has indicated they may release earlier if exploitation is observed.
This is a high-urgency event. PHP runs roughly 75% of the web. Two unauthenticated RCE flaws affecting every major PHP version from 5 through 8 means the attack surface is enormous — from legacy CMS installations to modern API backends. The fact that exploit details have already leaked into public forums significantly compresses the window between patch availability and active exploitation.
Vulnerability Summary
| Field | Details |
|---|---|
| CVE Identifiers | CVE-2026-109618, CVE-2026-109619 |
| Severity | CVSS v4.0 9.2 (PHP advisory) / CVSS 10.0 (watchTowr assessment) |
| Vulnerability Type | Remote Code Execution (unauthenticated) |
| Affected Versions | PHP 5, 6, 7, and 8 (per watchTowr) |
| Active Exploitation | Not yet observed in the wild (as of October 20) |
| Patch Availability | October 21, 2026 at 14:00 UTC — emergency release |
| Embargo Status | BROKEN — details leaked on Hacker News and X |
Why This Matters
The leak of embargoed vulnerability details before patches are available is one of the worst-case scenarios for defenders. It creates an asymmetry where offensive researchers and threat actors may have functional exploit code before administrators can even download patches. watchTowr has already claimed to have reproduced CVE-2026-109618, which suggests weaponization is feasible and likely imminent.
The affected version span — PHP 5 through 8 — is particularly concerning because many organizations still run PHP 7.x on legacy applications, and some still operate end-of-life PHP 5.x instances that may never receive patches. These legacy deployments are effectively unpatchable against these flaws.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions (Before Patches Land)
- Inventory all PHP deployments across your environment within the next 12 hours. Identify every instance, its version, and whether it is internet-exposed.
- Deploy WAF rules to monitor and block anomalous PHP request patterns. If your WAF supports virtual patching, enable it and tune aggressively for the next 72 hours.
- Reduce attack surface by restricting internet exposure of non-essential PHP applications. Move internal-facing apps behind VPN or zero-trust access where possible.
- Prepare patching runbooks now. Pre-stage the update process for all PHP versions in your environment so deployment can begin the moment patches are released at 14:00 UTC.
- Monitor for early exploitation — enable enhanced logging on web servers, watch for unexpected child process spawns from PHP-FPM or mod_php, and alert on suspicious
exec(),system(), orpassthru()calls.
Post-Patch Actions
- Patch immediately upon release — do not wait for a maintenance window. These flaws warrant emergency change procedures.
- Verify patch application across all instances, including containerized PHP deployments which are frequently overlooked.
- For EOL PHP versions (5.x, early 7.x): if no patch is provided, plan immediate migration or implement compensating controls (WAF, network isolation, runtime PHP sandboxing).
- Conduct post-exploitation hunting — review web server logs for the past 30 days for indicators consistent with RCE activity, especially unusual outbound connections or file creation in web roots.
The leaked embargo means defenders are now in a race. Treat these CVEs as actively exploitable starting now — not when patches drop. Every hour of delay after 14:00 UTC on October 21 increases exposure.
