PHP RCE flaws leak ahead of October 21 patch release for versions 5-8

The PHP development team announced emergency security updates for October 21 to address two critical vulnerabilities after embargoed information leaked prematurely. Administrators are urged to prepare for immediate installation once the patches become available.

What happened

The PHP security team published an advisory on Tuesday warning administrators to prepare for emergency updates on Wednesday, October 21, at 14:00 UTC. These updates address two vulnerabilities, each rated 9.2 under CVSS v4.0, according to the advisory. The team noted it reserves the right to release updates earlier if details become public or evidence of active exploitation appears.

Security researchers at watchTowr told BleepingComputer that the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution issues affecting PHP versions 5, 6, 7, and 8. watchTowr CEO Benjamin Harris confirmed the vulnerabilities are real and that his team has reproduced CVE-2026-109618, though technical details remain withheld until patches are released.

Why it matters

PHP powers a vast number of websites, including major content management systems and e-commerce platforms. An unconfirmed report circulated a video of an exploit tool named PHP2Shell executing code on servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symphony, Drupal, and WHMCS, according to Ars Technica.

Despite the leak, watchTowr stated it has not observed exploitation in the wild. However, researchers from Sansec expect mass attacks to begin shortly after the patch release, while Webfence and Huntress have also issued advisories urging immediate preparation. One researcher estimated approximately 1.3 million Internet-connected hosts may be affected.

Next steps

• Identify internal owners responsible for managing PHP infrastructure within your organisation.
• Take a comprehensive inventory of all applications built on PHP versions 5 through 8.
• Plan a maintenance window starting at 14:00 UTC on October 21, with contingencies for earlier release.
• Create backups of site and database files before applying updates.

Detection notes

Teams usually monitor web server access logs for unusual request patterns or unexpected command execution signatures. Check for anomalous outbound connections from web servers that may indicate data exfiltration or beaconing to command-and-control infrastructure. Review file system integrity monitoring alerts for new or modified scripts in web root directories. Analysts often look for shell commands executed by the web server user account, which is a strong indicator of remote code execution. Containment typically involves isolating affected web servers from the network to prevent lateral movement while forensic evidence is preserved.

What to do and how to stay safe: PHP

• Audit your environment to identify all systems running PHP versions 5, 6, 7, or 8.
• Monitor the PHP.net homepage for announcements regarding an earlier-than-scheduled patch release.
• Ensure you have current backups of all web applications and databases before applying updates.
• Review firewall rules to restrict unnecessary inbound traffic to web servers until patches are applied.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions are affected by the leaked vulnerabilities?

watchTowr confirmed the flaws affect PHP versions 5, 6, 7, and 8.

When are the emergency patches scheduled to be released?

Patches are scheduled for October 21 at 14:00 UTC, though the team may release them earlier.

Have the vulnerabilities been exploited in the wild?

watchTowr stated it has not observed exploitation in the wild despite the information leak.