PHP Warns of Two Critical Flaws Ahead of Emergency Fixes

The PHP security team has given website operators advance warning of an unusually urgent update. Two critical vulnerabilities are due to be addressed in a release scheduled for Wednesday, 21 October 2026, at 14:00 UTC. Both carry a CVSS v4.0 severity score of 9.2, according to PHP’s official security notice.

For administrators, the immediate message is to get ready to patch, not to guess at an exploit that has not yet been publicly described. PHP says it will disclose the affected versions, fixed releases and technical details when the update becomes available. It has also said it may publish the fixes earlier if vulnerability details become public or evidence of attacks appears.

The official warning confirms that there are two critical issues and gives the planned release time and severity scores. It does not yet say which versions are vulnerable, what an attacker would need to exploit them, or whether the bugs can be reached through a typical website. Those omissions are deliberate while the fixes are being prepared. Until PHP releases its advisories, broad claims that every PHP installation is exposed should be treated cautiously.

Security researchers cited by BleepingComputer have described the issues as remote code execution flaws and identified them as CVE-2026-109618 and CVE-2026-109619. They also suggested older PHP branches might be affected. PHP itself has not confirmed those technical claims or the version range in its public notice. The researchers said they had not seen exploitation in the wild at the time of their statement.

There is also an important difference in the reported severity numbers. Some early accounts referred to a score of 10, while PHP’s published notice assigns each issue 9.2 under CVSS version 4. Scores calculated with different assumptions or versions of the system are not interchangeable. The official assessment is the soundest figure to use until the full advisories arrive.

Operators can use the hours before release to inventory the PHP versions running across production, staging and older applications. That includes PHP embedded in managed hosting packages, containers, virtual machines and self-managed servers. A website owner who does not control the server should ask the hosting provider how quickly it will deploy the official fixes.

Teams should also make sure they have recent backups, a tested rollback process and a maintenance window that allows them to upgrade soon after PHP publishes the affected and fixed versions. The correct build may arrive through an operating-system vendor or hosting provider rather than directly from PHP. Administrators should follow the security notices for the package they actually run and confirm the patched version after installation.

Until the technical details are released, it is not possible to recommend a vulnerability-specific firewall rule or claim that a particular configuration blocks the flaws. Sensible interim steps include limiting unnecessary exposure of administrative services, reviewing access logs and being ready to investigate suspicious activity. These measures do not replace an update.

The warning matters beyond developers because PHP sits behind many publishing, shopping and business websites. A serious flaw in the runtime could have consequences across a wide range of services, but the scale of actual exposure depends on the conditions PHP has yet to disclose. TechBooky has previously covered a separate hosting security issue affecting cPanel users; the practical lesson is similar: confirm which software is running on the server and who is responsible for patching it.

For now, the clearest action is preparation. Once the PHP release goes live, administrators will be able to compare their deployments with the official affected-version list, apply the appropriate fixed build and check whether any follow-up investigation is warranted. This article reflects the situation before the scheduled 14:00 UTC disclosure and should be updated when PHP publishes the full advisories.