# Critical PHP Zero-Day Vulnerabilities Leaked, Patches Expected October 22

> Two severe remote code execution flaws in PHP, rated CVSS 10.0, were prematurely disclosed online, leaving global web servers vulnerable ahead of official fixes.

By PrimaryBrief newsroom · Published 2026-10-20T21:07:51.390014Z
Canonical: https://primarybrief.com/article/critical-php-zero-day-vulnerabilities-leaked-patches-expected-october-22-9eca0e48

On October 20, 2026, details of two critical remote code execution vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, leaked online with a maximum CVSS score of 10.0 [1][5][8]. The premature disclosure occurred before official patches were released for the zero-day flaws [1][8].

This leak has put system administrators globally on alert as it revealed severe, unpatched security vulnerabilities in PHP, a widely used scripting language for web development [1][8][17]. The information became public before fixes were available, creating a window where systems running vulnerable PHP versions could be at risk of attack [1][8]. For organizations still using older, unsupported PHP versions, the risk is persistent, as patches will reportedly only be released for PHP 8 [8][17].

## What the records show
Information regarding two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, became public on October 20, 2026 [1][5][8]. These flaws carry a CVSS score of 10.0, indicating maximum severity [1][5]. The details first appeared on Hacker News in a "Tell HN" post by a user named "petecooper" [2][5][8]. The post, citing a "reliable source," indicated that an official announcement was scheduled for October 22, 2026, concerning these two PHP RCEs [5][18]. Petecooper explicitly stated, "I have no evidence beyond 'source: trust me, bro', but if you're running PHP in production, be ready to update as a priority" [5][18]. The post also claimed these CVEs affect "all affected PHP versions from PHP 5 onwards" [5][18].

Following this initial leak, security firm WatchTowr publicly confirmed the authenticity of the zero-day vulnerabilities on October 20, 2026 [8][17]. WatchTowr stated the leak was premature, as a coordinated disclosure had been planned for Thursday [8][17]. The company urged administrators to treat the situation seriously and to apply patches once they become available [8][17]. Security researcher Florian Roth also commented on the matter via X, stating that the vulnerabilities are RCE flaws within the PHP core and that only PHP 8 would receive patches [8][17]. This means PHP versions from 5 up to 7.x are expected to remain vulnerable [8][17].

## The timeline
The vulnerabilities were first publicly disclosed on Tuesday, October 20, 2026, through a post on Hacker News [1][5][8]. This was ahead of the planned official announcement and patch release, which are scheduled for Thursday, October 22, 2026 [1][5][8]. The Hacker News post by petecooper indicated a disclosure time of 18:00 CEST on October 22 [5][18]. WatchTowr, in its confirmation, mentioned a planned disclosure time of 11:00 a.m. ET for Thursday [8][17]. Until these official advisories and patches are released, the flaws represent unpatched zero-days in PHP installations across the globe [8][17].

## What changed and for whom
The premature leak has forced system administrators and security teams to operate with urgent awareness of critical vulnerabilities for which no official fixes yet exist [1][8][17]. This creates a period of elevated risk for any organization running PHP applications, as potential attackers now have advance notice of severe flaws [1][8]. A significant change for users of older PHP versions, specifically PHP 5 through PHP 7.x, is that they will likely not receive patches [8][17]. This leaves a large segment of legacy PHP installations permanently exposed to these maximum-severity remote code execution flaws, increasing their long-term risk profile [8][17]. For those running PHP 8, the imminent patches will be critical for mitigation [8][17].

## What the subject has said publicly
WatchTowr stated publicly on October 20, 2026, that the leaked information concerned "zero-day embargoed RCE vulns in PHP" and confirmed, "We can confirm that they're real" [8][17]. The security firm noted that everyone involved in the coordinated disclosure "was supposed to wait until Thursday at 11am ET" [8][17]. WatchTowr also urged administrators to "Take this seriously and apply patches when available" [8][17]. Security researcher Florian Roth posted on X that the vulnerabilities are RCEs in the PHP core, have a CVSS score of 10.0, and only PHP 8 will receive patches [8][17]. The initial poster on Hacker News, "petecooper," acknowledged having "no evidence beyond 'source: trust me, bro'" for the initial claim [5][18].

## What we could not confirm
PrimaryBrief could not independently confirm the specific technical details or exploit vectors of the two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, as these details remain under embargo until the official disclosure [8][17]. The exact circumstances that led to the premature leak of this information on Hacker News are also unclear [5][18]. The identity of the "reliable source" cited by the Hacker News poster "petecooper" was not revealed [5][18].

## Evidence cited
1. PHP warns admins of two critical flaws, emergency patches coming tomorrow (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
2. ycombinator.com (ycombinator.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFmu56Xj2f4mpXo7WL3l217pcKdNuZIe5lV2UqEicGnDJ5_eq5r187bXnJFzeB8W_q_TVBJ0LuoK7Lx6nh1-02HovJT5OXtVONWnwX7Of7KxtXZvXYVwxs75Y00e1fR7hH8zdM4ZvMT
3. cyberkendra.com (cyberkendra.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGaGCUt4pet27A4-8HYOR0yJ3oUh9TfVUlIm6_ecOoBV4Q1ojS4V_Bmmx6GlSR18PjZOUfoH2lgVfMj28rIHEek31S8OyPCnEmMy2TP5uyJ3_yd-M0HK7NagKRjQO-YSWX-Fu6OxMcGla1CEdtx28sCIgJjrqicHbxnsI1BL6Nf4skt668fCyfH-sgYjfOi_8XODPA=
4. cyberkendra.com (cyberkendra.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHFTXgoTu9vA0XyUBUPiuims2bqUabWNJDgm8N8c_1StjjO9kmYg9aHAgQThwYm6-h7v1EDUgHfAEM29EjXqKD7v7zFu_t4FUsddioerGkAr0ppJ0HmgANLWAIkEx_idzDVEskCX2hDCVTeaGFEGzYg8dCKANcf8HkFpICWzP7UL-Z8vmKd46XDV8A=
5. ycombinator.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEMqMpevFgSR3tIkBVpCQr56KvRHGZqV6VyOAixLD6uZrroOh6MIFGo2HAC9i7yiTOzMOvgic-hVuN41NtsR0f9P2egmvKhCFaSd0U42Aa4ZTAZEJeWDMw0t9qMQ1XhJUPqYKmsdsKoLA==
6. ycombinator.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHWJxgBRnFc7-DKxP8Hs6hfI9kjr3plLcLONUJ0ZmkhS9zB605za9ri3K_ePVEVBB7fun0mX1xJMh--UtFXRBeSGycT8W_6qh13YGnll1LY8gM2b-I_NVClgZcwwZF3LPxg2z_hHBD7Eg==
7. cyberkendra.com (cyberkendra.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQETAijLEEEpWircikENEqefgUP113h3z-15jgj502_FsX6vkln6We_-ac3u8_UufrnKid1JpfaFoFUbpm-d_VhQ_F6HDnYQvkhpZ1GhVGz2dCrcTIO2sh3ZrmXeFC-6ZGmhwWL8360SWtTbQ-PeZaIkI8ulgm4CpX8KN-jR6XKj2ZaVAIkem7OajTrp
8. cyberkendra.com (cyberkendra.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQH-UzPcjsAagEi2zjDFslvcGAszSmOP-RAkMzuiNpV7aWkggNzgV18QLrge-Dj_T9FAgBxWYqFYw6kYRebM3aOospWIe-PYQ2Eum-a24LIo1nF8YLgGoL3PiMSAaNGikPa1Vkw83D9YKV5rQTUVFaTEZDZst3RJAA8MsRSlCtR-5fpT669oJedgSNDf
9. ycombinator.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEMqMpevFgSR3tIkBVpCQr56KvRHGZqV5VyOAixLD6uZrroOh6MIFGo2HAC9i7yiTOzMOvgic-hVuN41NtsR0f9P2egmvKhCFaSd0U42Aa4ZTAZEJeWDM0t9qMQ1XhJUPqYKmsdsKoLA==
10. watchtowr.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHOIQExHn0FUYoghR-pzKhpSva0O2UU4R-l0Xci0_HnXq9L1poUteTybGakivl7J6hA4_3HZoq6b1iFEX3s1rRLaVNduJ5BIXhdJ26SGSujjTlgjJaosxMYtcXqpvdJviWZoN7GVynVGkmhAP27jZeumz6nvNVQ
11. ycombinator.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHp3EZDAdmvCYX0mDblO7Hw9JEYRDdyrpXsv40EXt3DXtQ9vkHdbnlqugtMhkLLM--z3atRIq3EzGuH3vATfOZ1PlG7hdMZCBAeruzhYSmyAriXJSMADqUeENa8i-6n_FDAxZynJauQbg==
12. cyberkendra.com (cyberkendra.com) — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHE0uZARISvY9qWyUyBE95x-t1GG-RJcaR7s_0eK8yTcIASJB2w8mWiknUz8kfgweEIu1AhFqGP0faOdHFcIFnTzC7xjbh0PXrNrcv3s2RAAWv-xmk-XxkhAc-UfWLI6SNrMcGuP0DET9i8CTNTOjWRP8bQANywnYdW83c-vndQgnjKGfAUNyFlB_5c
13. watchtowr.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGRsUfUKfH13m5DZUTRm6sPIUR_MgmcmRX7zskpStsjYSV1GyZ-wRjorVYqkBC7KPYw9hOKnuTDXf9F56RUspRhOsCw55opd5A-Ny4G6v6XuKMAF3UtHRQ54O_FfEBDBx6vOIMDKZZuPwZhyFEldXq_ywFcW9k
14. cyberplace.social — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQE8gFuXlW1dpHvPgKVRZlEwFbQYNxqkBICZj_PO2UlyrCxncxlYK5VM-Ufbt19kIYPsA7kaMJpjVhwigrImaGok2aJ1DxzbqE_kUqahiT_6EmFFhrmwN75ZB0cG9Y_y3Ru5S49xraC2eInv52nQ35dqiqXO
15. ycombinator.com — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQGZXKZMuyim4VOyKDEhD8zAKMplHjlH776OR4p9OORUkcj2KWhYfwjsij5R0OfVYyH8C9rB9-XCnqQ9_YSrXAEFEycZk-Itm3yGT6s96YT0lYuBhHkkaX4QKXU_ABP-hukwMoMmjK38
16. watchTowr — https://watchtowr.com/
17. CVE-2026-109618 and CVE-2026-109619: watchTowr confirms leaked CVSS 10 PHP RCE zero-days. Patches due October 22; only PHP 8 gets fixes. (cyberkendra.com) — https://cyberkendra.com/
18. Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming. — https://ycombinator.com/