PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan

Attackers exploiting these reported vulnerabilities could execute their own code on affected PHP servers, according to watchTowr. This capability allows adversaries to run arbitrary commands on the system. The source material does not specify whether authentication is required or what specific actions attackers might take beyond code execution. The potential for remote code execution remains the primary concern for administrators managing PHP infrastructure.

How it unfolded

• A leak on October 20, 2026, stated two PHP RCE flaws would be disclosed on October 22.
• WatchTowr confirmed the leak's existence on social media without sharing technical details.
• PHP announced an emergency release for October 21, 2026, at 14:00 UTC, rating flaws 9.2.

Who is affected

PHP maintainers stated that the upcoming update will address two critical vulnerabilities, each rated 9.2 under CVSS v4.0, according to GBHackers. The official notice does not yet link these scores to specific CVE identifiers, leaving the exact technical scope unconfirmed by the vendor. WatchTowr has associated the reports with CVE-2026-109618 and CVE-2026-109619, but PHP has not verified these links. The leak suggested all versions from PHP 5 onward are affected, a claim neither PHP nor watchTowr has confirmed. Only supported branches receive patches; end-of-life versions will remain unpatched.

The fix

PHP will ship an out-of-cycle security release at 14:00 UTC on October 21, 2026, according to The Hacker News. This update targets the four currently supported branches: 8.2, 8.3, 8.4, and 8.5. Versions 8.2 and 8.3 receive security fixes only, while 8.4 and 8.5 are in active support. Older versions, including 8.1 and below, are end of life and will not receive a vendor patch. PHP maintainers may release the update earlier if vulnerability details become public or evidence of active exploitation emerges.

What made it possible

Remote code execution flaws typically stem from improper handling of user-supplied input within the interpreter. Attackers often exploit these weaknesses by injecting malicious commands that the server processes as legitimate instructions. This technique bypasses standard application logic, granting direct system access. Teams usually monitor for unusual process creation or outbound connections from web servers, as these behaviors often indicate successful exploitation of underlying interpreter vulnerabilities before full control is established.

What to do and how to stay safe: PHP

• Verify current PHP versions against the supported branches list (8.2 through 8.5) to determine patch eligibility.
• Monitor official PHP channels for the release announcement on October 21, 2026, or earlier if exploitation occurs.
• Ensure web application firewalls are configured to detect and block suspicious command injection patterns.
• Review server logs for anomalous activity that might indicate unauthorized code execution attempts.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are CVE-2026-109618 and CVE-2026-109619 confirmed by PHP?

No, PHP has not confirmed these identifiers or linked them to the 9.2 rated vulnerabilities.

Which PHP versions will receive the security patch?

Only the four supported branches, 8.2, 8.3, 8.4, and 8.5, will receive the fix.

Is there evidence of active exploitation in the wild?

As of October 21, watchTowr reported no known exploitation, but this does not confirm it is impossible.