PHP warns admins of two critical flaws, emergency patches coming tomorrow

The PHP development team has moved up release of urgent security fixes to Wednesday, October 21 at 14:00 UTC, after details about two critical bugs apparently leaked ahead of schedule. The flaws, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 under CVSS v4.0 and reportedly impact PHP branches 5, 6, 7, and 8, affecting the engine that underpins countless CMS platforms, online stores, and custom web apps. Researchers at watchTowr say both issues allow remote code execution, claim to have independently reproduced CVE-2026-109618, and insist they have seen no active exploitation yet, though their own severity estimate (CVSS 10) and timeline differ slightly from PHP's official statement. The PHP team has withheld technical specifics and a list of fixed versions until the patches ship, but says it may push the release even earlier if exploitation is detected or more information surfaces publicly.