Critical Remote Code Execution Vulnerabilities in PHP (CVE-2026-109618 & CVE-2026-109619)

Executive Summary

On October 20th, 2026, the PHP security team gave advance notice of a security release addressing two critical vulnerabilities. Information about the embargoed flaws leaked publicly the same day. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws are reported to allow remote code execution (RCE) on affected PHP installations. PHP has not published affected versions, but public reporting indicates all releases from PHP 5 onward are affected. PHP has scheduled fixed releases for October 21st, 2026, at 14:00 UTC.

PHP is the server-side language behind WordPress, Drupal, Magento, and most shared hosting, so a remotely exploitable flaw in PHP reaches a large share of internet-facing web applications. The leak broke the embargo that lets hosting providers and Linux distributions ship patched builds alongside the advisory.

No exploitation or public proof-of-concept (PoC) is reported at the time of writing. Given the reach of PHP, the critical rating of both flaws, and their early public exposure, Beazley Security recommends affected organizations apply the mitigations below until fixed versions are released, then apply fixed releases as soon as possible.

Affected Systems or Products

Mitigations / Workarounds

PHP has not published workarounds for either vulnerability and states that full details, affected versions, and fixed versions will be released with the security update. The current releases, PHP 8.5.11, 8.4.26, 8.3.35, and 8.2.34, shipped on September 24th, 2026, and predate the fix. Security researcher Florian Roth reports that only PHP 8 will receive patches, which PHP has not confirmed. PHP has not said whether the 8.0 and 8.1 branches, which did not receive the September releases, will get fixes. PHP 5 and PHP 7 reached end of life years ago, so systems on those versions should move to a supported PHP 8 branch.

Until fixed releases are available, the following may help to temporarily reduce risk:

• 

  Inventory every server, container image, and appliance that runs PHP, including PHP bundled inside third-party products, and record the version each runs (for example with php -v).

• 

  Confirm with hosting providers and Linux distribution maintainers when they will ship patched PHP builds, since many sites depend on them for PHP updates.

• 

  Restrict PHP applications that do not need to be public to trusted and administrative networks, and consider isolating internet-facing PHP applications that cannot be patched promptly.

• 

  Prioritize migration of any remaining PHP 5, PHP 7, PHP 8.0, and PHP 8.1 systems to a supported PHP 8 branch.

Patches

PHP has scheduled fixed releases for Wednesday, October 21st, 2026, at 14:00 UTC, and reserves the right to release earlier if details of either vulnerability become public or exploitation appears in the wild. PHP will announce fixed versions and full details in the PHP news archive. Organizations that rely on a hosting provider or a Linux distribution for PHP should apply the patched builds those providers ship.

Threat Intelligence

Information about the embargoed flaws surfaced on October 20th, 2026, in a "Tell HN" post on Hacker News. Citing a "reliable source", the poster claimed two PHP RCE flaws affecting all versions from PHP 5 onward would be announced on October 22nd, and admitted having no evidence for the claim. Hacker News flagged the post, but screenshots circulated on X and Mastodon, and Kevin Beaumont flagged the leak publicly.

The security firm watchTowr confirmed the same day that the leaked information concerns real, embargoed RCE vulnerabilities in PHP and said it could not share further details. Security researcher Florian Roth described the issue as an RCE in the PHP core and stated that only PHP 8 will receive patches. Researcher Nicolas Krassas said he will release a hands-on lab for the flaw once the embargo lifts.

The leaked disclosure date of October 22nd differs from PHP's own announcement, which schedules the release for October 21st at 14:00 UTC. No exploitation in the wild has been reported at the time of writing.

Technical Details

CVE-2026-109618: Remote Code Execution

PHP has announced two critical vulnerabilities for its October 21st, 2026 security release, which CERT-EU identifies as CVE-2026-109618 and CVE-2026-109619. Public reporting describes CVE-2026-109618 as a remote code execution flaw affecting PHP from version 5 onward, and Florian Roth describes the issue as an RCE in the PHP core. PHP has not released technical details. The affected function or extension, the exposed configurations, and whether authentication or user interaction is required have not been disclosed. CERT-EU notes that the severity rating indicates the potential for unauthenticated RCE, but PHP has not confirmed the preconditions. The CVE record remains reserved, and no public PoC is known at the time of writing.

CVE-2026-109619: Remote Code Execution

CVE-2026-109619 is the second flaw CERT-EU ties to the same PHP security release. Public reporting also describes it as a remote code execution vulnerability affecting PHP from version 5 onward. Its CVE record is also reserved, PHP has not released technical details, and no public PoC is known at the time of writing.

This advisory covers both CVEs together because PHP announced them as a pair in one security release, the leak named both, and watchTowr confirmed them together. PHP has not said whether the two flaws are related or can be chained.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this vulnerability and need support, please contact our Incident Response team.

Sources

• 

  NVD: CVE-2026-109618

• 

  NVD: CVE-2026-109619

• 

  PHP: Upcoming Critical PHP Security Release

• 

  watchTowr: Confirmation of embargoed PHP RCE vulnerabilities

• 

  oss-security: Upcoming Critical PHP Security Release

• 

  CERT-EU: Critical Vulnerabilities in PHP (2026-018)

• 

  Cyber Kendra: PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early

• 

  Kevin Beaumont: PHP vulnerability leak post