Key points
- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2.
- Patches are scheduled for release on October 21, 2026, at 14:00 UTC, potentially earlier if exploitation is detected.
- All PHP versions from PHP 5 onwards are affected by these unauthenticated remote code execution flaws.
Administrators managing PHP environments must prepare to apply security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, scheduled for release on October 21, 2026. As Patch Review reported on October 21, 2026, PHP maintainers have warned that these severe flaws affect versions dating back to 2004. The official patches are planned for 14:00 UTC on that Wednesday, though the maintainers indicated the release could occur sooner if technical details leak or evidence of active exploitation emerges.
In plain English
These two flaws, collectively referred to as PHP2Shell, allow attackers to execute arbitrary code on vulnerable servers without needing to log in first. According to SecurityWeek, both issues have a CVSS score of 9.2, indicating a critical severity level. CERT-EU notes that the high scores suggest the bugs can be exploited without any form of authentication. This means an attacker on the internet could potentially gain full control over a server running affected PHP versions simply by sending a specially crafted request.
The background
Public details regarding the specific root causes or affected components remain limited, but one report identifies CVE-2026-109618 as a use-after-free bug. SecurityWeek states that all PHP versions from PHP 5 onwards are susceptible to these issues. While WatchTowr CEO Benjamin Harris confirmed the vulnerabilities are real after reproducing CVE-2026-109618, he withheld technical specifics. Both WatchTowr and Huntress reported no evidence of in-the-wild exploitation at the time of reporting, though Sansec warned mass exploitation could begin within fifteen minutes of the patch release.
Who needs to act first
Teams should prioritize updating internet-facing web servers that run legacy PHP versions, as these systems present the highest exposure to unauthenticated attackers. Before applying any updates, ensure you have verified backups of your current configuration and data to allow for quick rollback if compatibility issues arise. Test the patches in a staging environment that mirrors your production setup to check for application breakage. Monitor network logs for unusual outbound traffic or new processes that might indicate early exploitation attempts while waiting for the official fix.
What to do and how to stay safe: PHP
- Inventory all servers running PHP to identify which hosts are using versions from PHP 5 onwards.
- Prepare automated deployment scripts or manual patching plans to apply the update immediately upon release.
- Restrict network access to PHP services where possible to limit exposure until patches are applied.
- Monitor server logs for signs of unauthorized code execution or unexpected shell access attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When are the patches for CVE-2026-109618 and CVE-2026-109619 available?
Patches are scheduled for release on October 21, 2026, at 14:00 UTC, but may be released earlier if exploitation is detected.
Which PHP versions are affected by these vulnerabilities?
All PHP versions from PHP 5 onwards are affected by these critical remote code execution flaws.
Are these vulnerabilities currently being exploited in the wild?
WatchTowr and Huntress have not seen evidence of in-the-wild exploitation, though mass exploitation is expected shortly after patching.
