PHP releases emergency patches

PHP is set to release emergency security patches on Wednesday, October 21, at 16:00 Paris time (14:00 UTC) to address two critical vulnerabilities. The patches aim to resolve issues that could allow attackers to execute arbitrary code remotely.

Vulnerabilities affect a large portion of websites

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are rated as highly severe. PHP assigns them a score of 9.2 out of 10 using the CVSS v4.0 standard, though some sources suggest a maximum score of 10. These flaws could impact 69.3% of websites that use PHP as their server-side language, according to W3Techs data.

Leak of vulnerability details precedes official notice

Details of the vulnerabilities were leaked before the official announcement. A user named "petecooper" posted on Hacker News on October 20, revealing the existence of two remote code execution (RCE) flaws in PHP. The post was later removed, but some media outlets, including BleepingComputer, were able to access its contents before the official notice.

Older PHP versions remain in widespread use

According to watchTowr, the vulnerabilities affect multiple PHP versions, including PHP 5, 6, 7, and 8. Although PHP 6 was never officially released, the widespread use of older versions like PHP 7 and 5—both of which are no longer supported—raises concerns. As of October 20, 27% of PHP sites still use PHP 7, and 7.7% use PHP 5, a version from 2004.

Patches and attack risks will be released simultaneously

PHP plans to release technical details about the vulnerabilities at the same time as the patches. Researchers from Sansec, a security firm specializing in e-commerce, warn that attackers may attempt to exploit the flaws within 15 minutes of the disclosure. Website administrators are urged to check their PHP version using the command php -v and schedule updates during a maintenance window. Fixed versions will be published on php.net at 16:00 Paris time.