PHP to patch two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, at 14:00 UTC today as details leak

The PHP project will release fixes for two critical vulnerabilities today, Wednesday 21 October 2026, at 14:00 UTC, and website operators have been told to prepare now. The PHP security team rates both flaws 9.2 on the CVSS v4.0 scale and says it may release earlier if details become public or if attacks start. Security firms say details have already leaked and that early attacks are under way. At the time of writing (about 13:20 UTC) the fixed versions had not been published, so this article covers what is known before the patch and will be updated when it lands.

Key points

• php.net announced on 20 October a security release for Wednesday 21 October 2026 at 14:00 UTC addressing two critical vulnerabilities, both rated CVSS v4.0 9.2; full details and fixed versions "will be published with the release".
• The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Security firm watchTowr has confirmed they are real remote code execution (RCE) bugs, according to Ars Technica and Sansec.
• Details leaked before the patch: a video of an exploit tool called PHP2Shell, credited to Calif.IO, circulated showing code execution on popular PHP applications. The leak is unconfirmed by the PHP project.
• Cloudflare's chief technology officer, Dane Knecht, says it is "seeing early attacks emerging" and has switched on temporary firewall rules for all customers; Sansec expects "mass attacks within 15 minutes of the release".
• The fix cannot be delivered by an application update: it must be applied to the PHP installation itself, and PHP supports only version 8.2 and later, according to Sansec.

What happened

On Monday 20 October, php.net published an advance notice of a security release scheduled for 21 October at 14:00 UTC. It says the release addresses two critical vulnerabilities, "both rated CVSS v4.0 9.2", urges all PHP users to prepare now, and adds that the project reserves "the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild".

The notice came after purported details leaked. According to Ars Technica, the leaked report showed a video of an exploit tool named PHP2Shell executing code on web servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS. Ars says it could not locate the original report, so the claims are unconfirmed. The security firm watchTowr, however, said it confirmed that the two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are real, and said the report claimed to affect every PHP version from PHP 5 onward. Sansec reads the leaked tool's banner as claiming PHP 5.4.0 and later, and says the exploit tool is credited to Calif.IO.

Sansec's timeline puts the sequence at: a Hacker News post on 20 October at 15:20 UTC reporting two upcoming PHP RCE disclosures; PHP's announcement and watchTowr's confirmation later that day; a PHP core developer saying on 21 October at 02:13 UTC that patching is the only mitigation; Cloudflare reporting early attacks and deploying firewall rules at 07:43 UTC; the PHP Foundation warning at 08:48 UTC that the volunteer-run Remi repository will not publish updates on 21 October; and, by 10:35 UTC, several Dutch sites offline as a precaution, namely tech site Tweakers, the House of Representatives, the National Cyber Security Centre and Security.NL.

The Verge adds that the EU's computer emergency response team and the UK National Cyber Security Centre have issued advisories encouraging organisations that cannot patch immediately to isolate internet-facing apps or take them offline, that WordPress security vendor Wordfence warned the fix cannot be installed through automatic updates, and that the GrapheneOS project took its user forum offline because proof-of-concept exploits are being developed. We have not opened those advisories ourselves.

Background

PHP is the language behind a large share of the web's content management systems and stores, which is why the advance notice has drawn such a reaction. The Verge cites a WordPress claim that it powers more than 40 percent of the internet, and notes that one security researcher estimated more than 1.3 million internet-connected hosts could be affected. Neither number comes from the PHP project, and they are estimates of exposure, not counts of vulnerable servers.

The previous batch of PHP security releases was on 24 September 2026, when php.net shipped 8.2.34, 8.3.35, 8.4.26 and 8.5.11, the versions it currently lists as the latest.

How it works

Neither the PHP project nor watchTowr has published a technical description, and the bugs' root cause is not confirmed. What exists today is advice from third parties who have not seen the patch either:

• Sansec suggests blocking multipart/form-data requests at the web server so that PHP never parses them. It warns this breaks file uploads on the site (for example in Magento's admin or WordPress's media library) and some checkout forms, and says to remove the rule after updating.
• Sansec also suggests putting a site behind a web application firewall. Cloudflare says it has deployed rules against the known exploits for all customers, including the free plan, and Knecht calls them a stopgap. Sansec cautions they protect a site only if the origin server refuses connections that do not come from Cloudflare.
• PHP core developer Gina Peter Banyard says patching is the only mitigation, and that taking servers offline might be the most sensible thing to do, according to Sansec and The Verge. Sansec proposes session.upload_progress.enabled = 0 and session.use_strict_mode = 1 as extra hardening but says explicitly that they are no guarantee, and Banyard's reply was to a suggestion to disable upload progress alone.
• Sansec notes that the built-in maintenance modes of Magento and WordPress do not help, because PHP still parses each request before the application checks the maintenance flag.

We cannot verify whether any of these measures stops the attack, because the technical details are unpublished. Treat them as stopgaps from the security firms that proposed them.

What it means

For site owners and developers. Work out who manages PHP on your servers, list the applications that depend on it, back up files and databases, and plan to upgrade the moment the release appears. Ars lists the same preparation steps, including a maintenance window from 14:00 UTC. Because the update has to be applied to the server's PHP itself, a plugin or core update from your CMS will not fix it, and Wordfence's warning that the fix cannot be installed through automatic updates points the same way.

For hosting customers. Ask your provider when it will upgrade. Sansec says that servers running PHP 8.1 or older will not get an official fix and need a backport or a move to a supported version. People who install PHP from the Remi repository, common on RHEL-based servers, will not get the fix on 21 October per the PHP Foundation's warning, and Sansec recommends switching to distribution packages or building from source.

For the industry. A leak of a pre-patch exploit video, followed by attacks within hours and public-sector sites going offline, is a reminder that coordinated disclosure windows can collapse quickly.

What we don't know yet

• The affected and fixed version numbers, which the project says it will publish with the release.
• The technical cause and the exact conditions for exploitation, including whether the sites shown in the video were running default configurations.
• Whether the PHP2Shell tool shown in the leaked video is real and what it requires; the report was unconfirmed, and the original could not be found by Ars Technica.
• How many servers are really exposed. The 1.3 million figure is one researcher's estimate quoted by The Verge.
• The scale of the attacks Cloudflare reports. It has said only that it is seeing early attacks.

What to watch next

• The php.net announcement at 14:00 UTC (or earlier) and the changelogs for the new 8.2, 8.3, 8.4 and 8.5 releases.
• Patches from Linux distributions, Docker official images and managed hosts, and Remi's repository.
• Statements from WordPress, Magento, Drupal and the other projects named in the leak, and whether exploitation spreads after the patch. Sansec expects attacks within 15 minutes.

We will add a dated update to this article when the fixed versions are published.

Sources

• php.net news archive: Upcoming Critical PHP Security Release, 20 October 2026 (primary)
• Sansec: Critical PHP RCE, CVE-2026-109618 and CVE-2026-109619
• Ars Technica: PHP warns it plans to release 2 emergency patches imminently
• The Verge: A critical PHP vulnerability may take websites down today