PHP security maintainers are set to release emergency patches for two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, today, October 21, 2026, at 14:00 UTC. Both flaws are rated 9.2 out of 10 under CVSS v4.0. Maintainers urged administrators to prepare for immediate upgrades, citing potential risks to users across multiple PHP versions.
PHP Team Schedules Release for Remote Code Execution Flaws
The PHP security team scheduled the release for Wednesday, October 21, 2026, at 14:00 UTC. While the maintainers have provided advance notice, they did not initially disclose the specific CVE identifiers or technical mechanics in their warning. However, the advisory from CERT-EU has since linked the release to CVE-2026-109618 and CVE-2026-109619, warning of potential remote code execution (RCE) without authentication.
According to security firm watchTowr, the vulnerabilities are believed to impact PHP versions 5, 6, 7, and 8. The firm stated that it had confirmed the existence of the flaws and warned that information regarding these zero-day issues had leaked prior to the intended disclosure date.
Risk of Early Disclosure and Exploitation
PHP maintainers have emphasized that they reserve the authority to expedite the release schedule if circumstances change. The team stated they might move up the deployment if details regarding the vulnerabilities become public or if evidence of active exploitation is observed in the wild. As of the time of its assessment, watchTowr reported that it had not seen active exploitation of the vulnerabilities.
Coordination with Laravel and Node.js Updates
The security release coincides with updates from the Node.js team, which also announced plans for security patches on October 21. Laravel News reported that the Laravel team is collaborating with the PHP Foundation to ensure updated versions are integrated into base images. The Laravel team advised users that they might need to redeploy their applications to incorporate these fixes.
Once the patches are live, PHP maintainers intend to publish full technical details and a list of affected versions. Administrators have been advised to verify their systems against the official affected-version list provided by the maintainers at the time of the release.
