SecurityNews
PHP starts shipping emergency fixes for two critical flaws
The PHP team rated both bugs 9.2 under CVSS v4.0, while watchTowr says they are remote code execution flaws reaching back to PHP 5.
What the reporting says
BleepingComputer reported ahead of the release that the PHP security team had told administrators to prepare for emergency updates on October 21, covering two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the project rated 9.2 on the CVSS v4.0 scale. Ars Technica added that source fixes reached the project's public repository at 13:34 UTC that day. CircleID reports that PHP then released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and that hosting companies and Cloudflare reported attack attempts the same day. The security firm watchTowr told BleepingComputer that the flaws allow remote code execution across versions 5 through 8, that it reproduced one of them, and that it gave a higher severity score than PHP did.
Read the original reporting
BleepingComputer
PHP warns admins of two critical flaws, emergency patches coming tomorrowMy Read
Commentary: opinion, not reporting.
BleepingComputer reports that the PHP security team told administrators to prepare for emergency updates on Wednesday, October 21, at 14:00 UTC. The updates cover two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0. Ars Technica added an update this morning: source fixes landed in the php-src GitHub repo at 13:34 UTC, and packages and docker images have begun to appear.
Here is what's established. The advisory exists, the scores are PHP's own, and the team said it could release early if details leaked or exploitation appeared. Here is what's claimed. watchTowr told BleepingComputer the flaws are remote code execution bugs affecting PHP 5, 6, 7 and 8, that it reproduced one of them, and that it has seen no exploitation. Its numbers differ from PHP's: it says CVSS 10 and a Thursday embargo date, against 9.2 and Wednesday. The sources also disagree on when the advisory went out, Monday per Ars Technica and Tuesday per BleepingComputer. Ars Technica could not locate the unconfirmed exploit report it mentions. Sansec says it expects mass attacks within 15 minutes of release. One researcher estimates 1.3 million exposed hosts, with no method given that I can see.
My read: an embargo is access control over a list of people, and the longer the list, the shorter the secret's life. Both outlets describe a leak ahead of schedule, and the maintainers moved fast. That part looks well handled. Once fixes sit in a public repo, though, the diff is a roadmap for anyone willing to read it, so the gap between patch and exploit shrinks to hours. The affected-version claim also bothers me. If PHP 5 is really in scope, I'd want to know whether old branches get fixes at all, or whether some admins are left with only mitigations. The vendor hasn't said, and I won't guess.
Watch the final advisory and release notes for the affected versions and the exact CVSS vectors. That will settle the gap between 9.2 and 10, and show which branches actually get patches.
Updates
Added what has happened since the story was first written: PHP shipped the fixes on October 21, and attack attempts were reported the same day.
- PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, according to CircleID and Huntress.
- Releases older than 8.2 are out of regular support. CircleID reports limited source patches from the PHP security team for 7.4, 8.0 and 8.1, and says some Linux distributors may backport fixes. Huntress says versions before 8.2 are unlikely to get official patches.
- CircleID reports that Patchstack's hosting partners described active exploitation and that Cloudflare saw early attacks, while Patchstack's own data showed probing without hard evidence of successful breaches as of 13:57 UTC. Huntress had not seen exploitation among its own partners as of 4:30 pm Eastern, but noted that other researchers were reporting attacks.
- The story was also shortened and rewritten in the site's current format, with sources added for these updates.
Discussion
Should maintainers publish a security fix to a public repository before the packages are ready?
Covered by 3 of 10 outlets we read, 1,403 points on Hacker News.