# PHP to Release Emergency Patches for Two Critical RCE Vulnerabilities After Leak

> The PHP security team is scheduled to release urgent patches today for two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, following a premature disclosure.

By PrimaryBrief newsroom · Published 2026-10-21T03:35:31.811591Z
Canonical: https://primarybrief.com/article/php-to-release-emergency-patches-for-two-critical-rce-vulnerabilities-after-leak-5742d239

The PHP security team is scheduled to release emergency security patches on Wednesday, October 21, 2026, at 14:00 UTC (10:00 AM Eastern), to address two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619 [2][6][15]. This urgent response comes after details about these flaws were prematurely leaked on October 20, 2026, ahead of their originally embargoed disclosure [9][10].

These vulnerabilities pose a significant risk because PHP powers approximately 75% of all websites that use a known server-side programming language, including platforms like WordPress, Drupal, and Joomla [8]. Attackers could exploit these flaws to run their own code on affected servers, potentially compromising a vast number of websites globally [13][14].

## What the records show

The PHP security team has confirmed that an upcoming security release is scheduled to fix two critical vulnerabilities [9][15]. These flaws are identified as CVE-2026-109618 and CVE-2026-109619 [10]. Cybersecurity firm watchTowr has confirmed the legitimacy of these vulnerabilities [10][13]. An alleged exploit tool named 'PHP2Shell' has been reported in connection with these vulnerabilities [1][16]. Both vulnerabilities are rated 9.2 under CVSS v4.0 [6]. Initial reports indicate these vulnerabilities may affect all PHP versions from 5 onward [13].

## The timeline

On October 20, 2026, details regarding the two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked online [9][10]. This leak occurred before their planned coordinated disclosure and before any patches were made available [9]. Following the leak, the PHP security team announced an upcoming security release to address these issues [9][15]. The patches are scheduled for release on Wednesday, October 21, 2026, at 14:00 UTC [6][7].

## What changed and for whom

The premature leak of vulnerability details has accelerated the release schedule for patches, requiring immediate attention from web administrators globally [10][14]. Websites running PHP versions 5.4 or later are potentially affected and will need to apply these fixes promptly once released [12]. The widespread use of PHP means a large segment of the internet is at risk, including sites built with WordPress, Drupal, Joomla, Laravel, Symfony, and Magento [8].

## What the subject has said publicly

The PHP security team issued an advisory notifying administrators to prepare for an upcoming security release to address two critical vulnerabilities [2][7]. They have stated the release is scheduled for Wednesday, October 21, 2026, at 14:00 UTC [6][7]. They did not publicly confirm the leak of details, but their accelerated patch schedule follows reports of such a leak [2][9][15].

## What we could not confirm

We could not confirm the exact technical details of the vulnerabilities (CVE-2026-109618 and CVE-2026-109619), as no official technical details have been made public yet [11]. The exact mechanism of the 'PHP2Shell' exploit tool and its direct connection to these specific vulnerabilities beyond unconfirmed reports also remains unconfirmed [1]. While some reports suggest the vulnerabilities affect PHP 5 and later, this has not been confirmed by a vendor advisory [13].

## Evidence cited
1. PHP warns it plans to release 2 emergency patches imminently (arstechnica.com) — https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
2. PHP warns admins of two critical flaws, emergency patches coming tomorrow (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
3. AfD-Hack: Was hinter den geleakten Mails steckt (www.politico.eu) — https://www.politico.eu/podcast/berlin-playbook-podcast/afd-hack-was-hinter-den-geleakten-mails-steckt/?utm_source=RSS_Feed&utm_medium=RSS&utm_campaign=RSS_Syndication
4. Trump Appointees Asked a Federal Cybersecurity Agency to Secretly Acquire a Voting Machine — and Hack It (www.propublica.org) — https://www.propublica.org/article/cisa-election-security-donald-trump
5. AI Safety and Cybersecurity Should Be Allies. Instead, They're at Odds (time.com) — https://time.com/article/2026/10/20/ai-safety-cybersecurity/
6. Laravel News - The official Laravel news source (laravel-news.com) — https://laravel-news.com/
7. r/PHP - PHP warns it plans to release 2 emergency patches imminently (reddit.com) — https://www.reddit.com/r/PHP/comments/17goxu9/php_warns_it_plans_to_release_2_emergency_patches/
8. HeroDevs - Extended Security Maintenance for End-of-Life PHP, Node.js, and Python Versions (herodevs.com) — https://herodevs.com/
9. Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) (huntress.com) — https://huntress.com/blog/rapid-response-php2shell-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619
10. PHP Core RCEs CVE-2026-109618 and CVE-2026-109619 Leak Ahead of Embargoed Disclosure (threatlandscape.io) — https://threatlandscape.io/threat-advisory/php-core-rce-cve-2026-109618-and-cve-2026-109619-leak-ahead-of-embargoed-disclosure
11. Security Advisory 2026-018 - Critical Vulnerabilities in PHP (europa.eu) — https://www.europa.eu/news/cert-eu/security-advisory-2026-018
12. Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619 (sansec.io) — https://sansec.io/research/php-critical-rce-october-2026
13. Critical RCE Vulnerabilities in PHP - watchTowr (watchtowr.com) — https://watchtowr.com/blog/critical-rce-vulnerabilities-php
14. Upcoming PHP core RCE vulnerability patches (CVE-2026-109618 & CVE-2026-109619) : sysadmin (reddit.com) — https://www.reddit.com/r/sysadmin/comments/17govp8/upcoming_php_core_rce_vulnerability_patches/
15. CVE-2026-109618 and CVE-2026-109619: PHP will patch leaked critical flaws on October 21 at 14:00 UTC. (cyberkendra.com) — https://cyberkendra.com/2026/10/20/cve-2026-109618-and-cve-2026-109619-php-will-patch-leaked-critical-flaws-on-october-21-at-1400-utc/
16. php2shell | Kali Linux Tools (kali.org) — https://kali.org/tools/php2shell/
17. はてなブックマーク - 人気エントリー (hatena.ne.jp) — https://hatena.ne.jp/hotentry/2026/10/21