From BigGo Finance · BigGo Finance · · 2m
PHP Security Update for Critical RCE Flaws
PHP releases emergency patch for two critical remote code execution flaws leaked ahead of schedule.
In brief
PHP releases emergency patch for two critical remote code execution flaws leaked ahead of schedule. PHP issued an emergency patch for two critical remote code execution flaws rated 9.2 under CVSS v4.0 that were leaked on Oct. 20, affecting PHP versions from 5 onward but with official support limited to 8.2 through…
Emergency PHP Security Update
PHP's security team announced an out-of-band security update for Oct. 21 at 14:00 UTC to fix two remote code execution flaws rated 9.2 under CVSS v4.0.
“CVE-2026-109618 CVE-2026-109619”
Leaked Details Triggered Early Release
The release comes a day earlier than the originally planned Thursday disclosure after details leaked on Hacker News on Oct. 20.
“Tell HN”
WatchTowr Confirms Flaws Exist
Security firm watchTowr confirmed the flaws are genuine and reproduced one of them.
“watchTowr said it had successfully reproduced the flaw numbered cve-2026-109618”
Scope of Vulnerabilities Unconfirmed
The leaked information claims all versions from PHP 5 onward are affected, but that scope has not been officially confirmed.
“all versions from php 5 onward”
Official Support Limited to PHP 8.2-8.5
PHP provides fixes only for its four supported branches: 8.2 through 8.5; end-of-life versions like PHP 5 and PHP 7 receive no official patch.
“php 5 and php 7”
Exposure Data Highlights Risk
Security firm Mallory estimates 884,000 internet-visible hosts report PHP 8.1 or earlier, accounting for 59% of 1.5 million hosts with PHP versions.
“884,000”
No Exploitation Observed
No exploitation in the wild has been observed, and PHP has not offered interim mitigations.
“no exploitation in the wild”
PHP 8 Branch Support Timeline
PHP 8.5 active support until Dec. 31, 2029; 8.4 until Dec. 31, 2:2028; 8.3 and 8.2 security fixes only until Dec. 31, 2027 and 2026.
“8.5 active support 2029-12-31”
Recommended Preparatory Steps
Security organizations recommend cataloging PHP installations, preparing upgrades, and isolating systems if immediate patching is not possible.
“catalog all php installations”
Japan Issues Preemptive Alert
Japan's Information-technology Promotion Agency issued a pre-emptive alert for organizations to apply the update immediately after release.
“Information-technology Promotion Agency”
Attack Timeline Estimates
Security firm Sansec expects large-scale attacks within 15 minutes of the update's release due to the compressed embargo period.
“large-scale attacks within fifteen minutes”
The key point
PHP issued an emergency patch for two critical remote code execution flaws rated 9.2 under CVSS v4.0 that were leaked on Oct. 20, affecting PHP versions from 5 onward but with official support limited to 8.2 through 8.5.
