PHP security team schedules urgent fixes for pair of critical vulnerabilities

The PHP development team has advised website administrators to brace for emergency security updates addressing two severe vulnerabilities. The patches are scheduled for release on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern). Both flaws carry a critical severity rating of 9.2 under CVSS v4.0. [5][6]

Official details remain under wraps, with developers withholding affected versions, exploitation methods, and specific patched releases until the rollout begins. However, the project's security team warned that fixes could arrive even earlier if vulnerability details leak publicly or if active exploitation emerges. Security firm watchTowr reported that the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution vulnerabilities spanning PHP versions 5 through 8, though the researchers noted they have not observed active attacks. [5][6]

The emergency timeline comes amid confusion caused by leaks on social media and the Hacker News forum. While those reports claimed the vulnerabilities carry maximum 10.0 severity scores and were originally set for a Thursday release, official maintainers confirmed the 9.2 rating and accelerated schedule. [6]