# PHP Security Update for Critical RCE Flaws

> PHP releases emergency patch for two critical remote code execution flaws leaked ahead of schedule.
- Title: PHP Security Update for Critical RCE Flaws · BigGo Finance
- Summary: PHP releases emergency patch for two critical remote code execution flaws leaked ahead of schedule. PHP issued an emergency patch for two critical remote…
- Keywords: php, rce, cvss, php 8, security patch, hacker news, watchtowr, cisa, php 5, php 7, php 8.2, php 8.5
- Source: BigGo Finance — https://finance.biggo.com/news/04b5e248-42fb-4f72-920b-b5c43a0f5c59
- Author: BigGo Finance
- Published: 2026-10-21T07:05:15+00:00
- Read time: 1 min
- Topics: php, rce, cvss, php 8, security patch, hacker news, watchtowr, cisa, php 5, php 7, php 8.2, php 8.5
## Emergency PHP Security Update
PHP's security team announced an out-of-band security update for Oct. 21 at 14:00 UTC to fix two remote code execution flaws rated 9.2 under CVSS v4.0.

> CVE-2026-109618 CVE-2026-109619
## Leaked Details Triggered Early Release
The release comes a day earlier than the originally planned Thursday disclosure after details leaked on Hacker News on Oct. 20.

> Tell HN
## WatchTowr Confirms Flaws Exist
Security firm watchTowr confirmed the flaws are genuine and reproduced one of them.

> watchTowr said it had successfully reproduced the flaw numbered cve-2026-109618
## Scope of Vulnerabilities Unconfirmed
The leaked information claims all versions from PHP 5 onward are affected, but that scope has not been officially confirmed.

> all versions from php 5 onward
## Official Support Limited to PHP 8.2-8.5
PHP provides fixes only for its four supported branches: 8.2 through 8.5; end-of-life versions like PHP 5 and PHP 7 receive no official patch.

> php 5 and php 7
## Exposure Data Highlights Risk
Security firm Mallory estimates 884,000 internet-visible hosts report PHP 8.1 or earlier, accounting for 59% of 1.5 million hosts with PHP versions.

> 884,000
## No Exploitation Observed
No exploitation in the wild has been observed, and PHP has not offered interim mitigations.

> no exploitation in the wild
## PHP 8 Branch Support Timeline
PHP 8.5 active support until Dec. 31, 2029; 8.4 until Dec. 31, 2:2028; 8.3 and 8.2 security fixes only until Dec. 31, 2027 and 2026.

> 8.5 active support 2029-12-31
## Recommended Preparatory Steps
Security organizations recommend cataloging PHP installations, preparing upgrades, and isolating systems if immediate patching is not possible.

> catalog all php installations
## Japan Issues Preemptive Alert
Japan's Information-technology Promotion Agency issued a pre-emptive alert for organizations to apply the update immediately after release.

> Information-technology Promotion Agency
## Attack Timeline Estimates
Security firm Sansec expects large-scale attacks within 15 minutes of the update's release due to the compressed embargo period.

> large-scale attacks within fifteen minutes
## Key takeaway

PHP issued an emergency patch for two critical remote code execution flaws rated 9.2 under CVSS v4.0 that were leaked on Oct. 20, affecting PHP versions from 5 onward but with official support limited to 8.2 through 8.5.