System administrators and web hosting providers are bracing for emergency software updates Wednesday after details surrounding two critical security vulnerabilities in the PHP programming language leaked online ahead of schedule.
The PHP security team announced in an advisory that it will publish an out-of-cycle release at 14:00 UTC (10:00 a.m. EDT) on Wednesday, Oct. 21. Both vulnerabilities have been assigned a severity score of 9.2 on the Common Vulnerability Scoring System version 4.0 scale. Official maintainers have not yet published technical descriptions or identified the exact mechanisms involved, pledging to reveal full details, affected versions and patched releases alongside the software updates.
Embargo breached online
The rushed schedule followed an unauthorized disclosure on the Y Combinator forum Hacker News on Tuesday. A user posting under the name “petecooper” claimed that two remote code execution flaws, designated CVE-2026-109618 and CVE-2026-109619, carried maximum CVSS ratings of 10.0 and were scheduled for disclosure on Thursday, Oct. 22.
Cybersecurity firm watchTowr subsequently verified on social media that the embargoed vulnerabilities are real, though it noted that researchers had originally planned to maintain confidentiality until Thursday morning, BleepingComputer reported. Benjamin Harris, chief executive of watchTowr, told BleepingComputer that both flaws allow remote code execution and are believed to affect versions dating back through PHP 5, 6, 7 and 8. The firm noted that it successfully reproduced the issue tracked as CVE-2026-109618 in lab testing.
Discrepancies remain between official announcements and researcher accounts. While the leaked posts and watchTowr described both flaws as carrying a perfect 10.0 score, the PHP security team formally evaluated both bugs at 9.2 under CVSS v4.0. The PHP team’s advisory did not list specific CVE numbers or describe the bugs as code execution issues.
Legacy systems face exposure
The PHP project currently maintains only four branches: versions 8.2 and 8.3 receive security-only maintenance, while 8.4 and 8.5 are under active development, The Hacker News reported. Older versions, including PHP 8.1, 8.0, and the widely deployed PHP 7 and PHP 5 series, have reached end-of-life status and will not receive official vendor patches.
Because PHP powers content management systems like WordPress, Drupal and Magento, the vulnerabilities could pose a substantial risk to large portions of internet infrastructure. Data compiled Tuesday by security company Mallory found about 884,000 internet-facing hosts reporting a PHP version of 8.1 or older in their server banners, representing roughly 59 percent of internet-exposed hosts displaying a specific version number, according to The Hacker News.
PHP maintainers warned that they “reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”
What happens next
Security firms including watchTowr and Huntress reported that they have seen no evidence of active exploitation in the wild, and neither flaw is currently listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. No workarounds have been published.
Major web platforms are already moving to deploy fixes. The Laravel development team announced it is coordinating with the PHP Foundation to integrate the patched software into its Forge and Cloud hosting environments as soon as the builds are made public, Laravel News reported. Administrators are urged to verify current server versions and prepare to upgrade supported PHP 8 environments immediately when files go live.
