PHP warned of two critical flaws before shipping a fix. The patch is due 21 October.
By Lior AharonovFounder, 7IT Solutions ·
On 20 October 2026 PHP warned of two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, and scheduled emergency updates for 21 October at 14:00 UTC. PHP rates each 9.2 on CVSS v4.0 but has not named affected versions or fixed releases; researchers at watchTowr say they have seen no exploitation.
PHP runs content management systems, shops and custom web services. A warning without a patch is a countdown: the details go public when the update does, and the race between your patch and their exploit starts that minute.
Find every PHP host and container you run today. Keep a window open after 14:00 UTC on 21 October and install the update the moment PHP names the fixed releases.
A patch date is a starting gun for two sides. Be at the line before the other side is.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.