PHP RCE flaws at 9.2 CVSS severity prompt emergency patches for October 21 after WatchTowr confirms leaks
Leaked details of two critical PHP vulnerabilities lead maintainers to schedule emergency patches for October 21.
Key points
- Two remote code execution flaws in PHP are rated 9.2 CVSS severity.
- WatchTowr researchers confirmed the leaks and reproduced one vulnerability.
- Patches are scheduled for October 21, with earlier release possible.
The attacker gains the ability to run arbitrary code on servers running PHP. Achieving this required exploiting one of two newly leaked remote code execution vulnerabilities. The flaws allow remote execution without the need for prior access to the system. This outcome gives the threat actor control over the application layer hosted on the server. The impact is severe because PHP powers a vast portion of web applications globally.
How it unfolded
- The PHP security team issued an advisory Tuesday warning of upcoming patches.
- WatchTowr reported that embargoed details leaked before the scheduled Thursday disclosure.
- Researchers confirmed the vulnerabilities are real and reproduced one flaw.
- The team announced patches would drop Wednesday, October 21, at 14:00 UTC.
Who is affected
Software relying on PHP is at risk, including WordPress, Drupal, and Laravel. WatchTowr stated the flaws affect PHP versions 5 through 8. This range covers software released since 2004. A video showed an exploit tool targeting specific versions of Magento and Joomla. The tool demonstrated code execution on servers running these content management systems. No evidence of wild exploitation was observed at the time of reporting.
View the original post on X
The fix
The PHP development team plans to release security updates on October 21. These updates address CVE-2026-109618 and CVE-2026-109619. The team reserves the right to release earlier if public details emerge. Administrators are urged to prepare to install updates immediately. The patches are intended to address the remote code execution issues identified by researchers. The source material does not confirm the patches are already available.
What made it possible
Remote code execution flaws typically stem from improper handling of input data. The weakness allows an attacker to inject commands that the server executes as if they were legitimate instructions. This technique serves the initial access stage of an intrusion. Teams usually monitor for unusual process spawning or outbound connections. Check whether your environment validates all external inputs before processing. Conceptually, the failure lies in trusting untrusted data sources. This bypasses application logic and grants direct system interaction.
What to do and how to stay safe: PHP
- Inventory all applications built on PHP to determine version exposure.
- Plan a maintenance window for patching starting at 14:00 UTC on October 21.
- Back up site and database files before applying any updates.
- Monitor the PHP.net homepage for announcements regarding an earlier release.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the leaked PHP flaws?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
Which PHP versions are affected by these remote code execution flaws?
WatchTowr believes the flaws affect PHP versions 5, 6, 7, and 8.
Has there been evidence of these flaws being exploited in the wild?
Researchers have not observed exploitation in the wild despite the leak.
