PHP CVE-2026-109618 & CVE-2026-109619: What to Do Before the Details Drop

PHP is preparing an emergency release to address two core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the PHP security team has scored at CVSS v4.0 9.2 each. Researchers believe both flaws allow unauthenticated remote code execution, though PHP's own advisory currently withholds technical specifics such as the vulnerable component, affected versions, or which releases will contain the fix. The patch is expected around 14:00 UTC on Wednesday, October 21, 2026, but could ship sooner if exploitation is detected or more details leak publicly. There is no confirmed in-the-wild exploitation at this time, though a screenshot of a tool dubbed 'PHP2Shell' has already surfaced online, and defenders are warned that fake proof-of-concept exploits are likely to circulate on platforms like GitHub and Telegram before the official fix lands — these should be treated with suspicion since they often carry malware rather than genuine working exploits. Organizations running PHP are advised to disable unused file-upload handling as a precaution and to prepare their teams to apply the official patch as soon as it becomes available.