The PHP security team has urged website administrators to prepare for emergency updates to address two critical vulnerabilities, amid reports that information about the flaws has leaked ahead of their planned disclosure.
In an announcement on 20 October, PHP developers scheduled the security release for Wednesday, 21 October, at 14:00 UTC — 3:00 a.m. Thursday, 22 October, in New Zealand.
Both vulnerabilities have been rated 9.2 out of 10 under version 4.0 of the Common Vulnerability Scoring System (CVSS), a standard used to assess the severity of software vulnerabilities.
Developers warned that the updates could be released earlier if vulnerability details become public or evidence of active attacks emerges. Administrators can monitor PHP's official announcements for the latest information and available security patches.
PHP is widely used to power websites and online services, including WordPress, Drupal and custom web applications. Security researchers believe the two flaws could permit remote code execution, potentially allowing attackers to run malicious instructions on vulnerable servers.
The vulnerabilities have been identified in researchers' reports as CVE-2026-109618 and CVE-2026-109619. However, PHP has not disclosed their technical causes, affected versions or the conditions required for exploitation.
Cybersecurity firm watchTowr told BleepingComputer that both vulnerabilities were genuine. Its chief executive, Benjamin Harris, said researchers believed they had reproduced one of them, CVE-2026-109618, while withholding technical information until patches become available.
Reports of a premature disclosure followed a post on technology forum Hacker News by a user named "petecooper", who claimed the flaws affected PHP versions dating back to PHP 5 and were originally scheduled for disclosure on 22 October. The claims have not been independently confirmed by PHP.
The Hacker News post and watchTowr initially assigned both flaws maximum severity scores of 10.0, higher than PHP's official assessment. The reason for the discrepancy remains unclear.
The European Union's computer emergency response team, CERT-EU, has advised organisations to identify PHP installations, prepare for immediate patching and consider isolating internet-facing applications where updates cannot be applied promptly.
Although watchTowr says it has not observed exploitation in the wild, the potential exposure remains uncertain until technical details are published.
Ubuntu released separate PHP security updates on 19 October, but its published advisory covered different vulnerabilities and does not confirm fixes for these newly reported flaws.
The PHP team says affected versions, technical details and security fixes will be published alongside the emergency updates, urging administrators to install the patches as soon as they become available.
