PHP Remote Code Execution Flaws Leaked Before Patch Release
Early disclosure of two critical PHP vulnerabilities forces administrators to prepare for immediate remediation before official fixes arrive.
Key points
- Two critical flaws, CVE-2026-109618 and CVE-2026-109619, were exposed via a forum post before scheduled patch release.
- The PHP security team confirmed the issues and adjusted the severity rating from the leaked maximum score to 9.2.
- CERT-EU urges users to prepare for patching as the vulnerabilities affect PHP versions dating back to PHP 5.
Attackers gaining access to these PHP flaws obtain remote code execution capabilities, allowing full server takeover. Achieving this access requires exploiting weaknesses present in PHP versions dating back to PHP 5. The early leak of identifiers and version ranges increases the risk of rapid exploitation by malicious actors before patches are widely deployed.
How it unfolded
- A user named ‘petecooper’ posted on Hacker News on October 20, revealing CVE identifiers and claiming disclosure on October 22.
- WatchTowr confirmed the vulnerabilities were scheduled for earlier disclosure alongside patches, contradicting the leak's timeline.
- The PHP security team released a bulletin on October 21, confirming patches were due at 2pm GMT that same day.
Who is affected
The vulnerabilities impact PHP installations running versions dating back to PHP 5. Because PHP powers approximately 69.7% of websites with known server-side languages, the exposure is widespread. Many content management systems, including WordPress, Drupal, Joomla, and Magento, as well as various e-commerce platforms, rely on this software stack and remain vulnerable until updated.
The fix
Patches for both CVE-2026-109618 and CVE-2026-109619 were scheduled for release on October 21 at 2pm GMT. The PHP security team stated they reserve the right to release updates earlier if evidence of active exploitation appears. The team assigned a critical severity rating of 9.2, lower than the maximum score suggested in the initial leak.
What made it possible
Remote code execution vulnerabilities typically arise from inadequate input validation or improper handling of data within the server environment. When attackers can inject and execute arbitrary commands, they bypass standard application logic. This class of flaw serves as a primary entry point for intrusions, allowing adversaries to establish persistent control. Teams usually monitor for unusual process creation or network connections that deviate from baseline behavior. Check whether your logging infrastructure captures detailed execution traces to detect such anomalies early.
What to do and how to stay safe: PHP
- Inventory all servers running PHP versions dating back to PHP 5 to identify exposure scope.
- Monitor system logs for unexpected command executions or new processes initiated by web services.
- Prepare deployment procedures to apply patches immediately once the vendor releases the updates.
- Restrict network access to management interfaces to reduce the attack surface while awaiting fixes.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the leaked PHP vulnerabilities?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
What severity rating did the PHP team assign to these flaws?
The PHP security team allocated a critical severity rating of 9.2.
Which PHP versions are affected by these vulnerabilities?
The flaws affect PHP versions dating back to PHP 5.
