Two Critical PHP RCE Vulnerabilities With CVSS 9.2 Score Put Web Servers at Risk

The PHP security team has announced an upcoming release that will address two critical vulnerabilities, each rated 9.2 under CVSS v4.0.

This warning, published on October 20, 2026, advises administrators to prepare for immediate upgrades. Additionally, watchTowr has reported two potential remote code execution (RCE) vulnerabilities. However, PHP has not yet confirmed their identifiers or technical details.

The official release is scheduled for Wednesday, October 21, 2026, at 14:00 UTC (7:30 PM IST). PHP maintainers said they could release patches earlier if vulnerability details become public or evidence of active exploitation emerges.

The security update will include information on affected versions, fixed releases, and full details about the vulnerabilities.

Two Critical PHP RCE Vulnerabilities

WatchTowr identifies the reported vulnerabilities as CVE-2026-109618 and CVE-2026-109619. Their FAQ suggests that these RCE vulnerabilities could allow attackers to execute their own code on affected PHP servers.

However, the company emphasizes that these details stem from an unverified report, so it’s essential to distinguish preliminary information from the vendor’s confirmed announcements.

The reported scope includes every PHP version from PHP 5 onward, but PHP maintainers have not verified this claim. Currently, no affected components, vulnerable functions, attack vectors, authentication requirements, or configuration prerequisites have been disclosed.

As a result, administrators cannot ascertain whether specific deployment models or application features might expose their systems to the reported flaws.

The official notice also does not associate its two 9.2 scores with named CVEs. While the announcements pertain to two PHP vulnerabilities, it is premature to link those scores conclusively to CVE-2026-109618 and CVE-2026-109619.

WatchTowr’s vulnerability table lists both identifiers but does not assign scores due to the limited information available before the planned release.

The announcements’ timing also differs. WatchTowr’s FAQ references a rumored announcement on October 22 at 18:00 CEST, based on information circulated through social media.

In contrast, PHP’s official notice specifies October 21 at 14:00 UTC. Security teams should adhere to the vendor’s published schedule when coordinating their response activities.

As of October 21, watchTowr reported no known exploitation occurring in the wild. However, this does not confirm that exploitation is impossible.

PHP’s warning that it may accelerate patch publication if attacks emerge highlights the need for teams to monitor official updates rather than assume the announced timeline is fixed.

Organizations should inventory their production PHP installations, identify responsible application owners, and establish update procedures before patches are released.

WatchTowr recommends that teams monitor official PHP security channels and promptly install confirmed fixed versions. With no publicly confirmed workaround, affected-version matrix, or technical trigger currently available, teams should avoid relying on speculative configuration changes to protect against these vulnerabilities.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.