Clarissa Hana
The PHP security team is issuing an urgent advisory to system administrators worldwide, urging immediate preparation for emergency security updates scheduled for Wednesday, October 21st. This proactive measure is being taken to address two critical vulnerabilities, each carrying a severe CVSS v4.0 score of 9.2, after information regarding these flaws was reportedly leaked ahead of their official, embargoed disclosure. PHP, the ubiquitous scripting language that underpins a vast proportion of the internet’s dynamic content and web applications, faces a potential wave of exploits if these vulnerabilities are actively leveraged before patches are deployed.
PHP’s pervasive influence on the digital landscape cannot be overstated. It serves as the foundational technology for a myriad of online services, including widely adopted content management systems like WordPress, Drupal, and Joomla, alongside numerous e-commerce platforms, custom-built web applications, and back-end services that power everything from social media platforms to financial transactions. The widespread nature of PHP deployment means that any security flaw affecting the language has the potential to impact millions of websites and billions of users globally.
The official announcement, published on Tuesday, October 20th, via the PHP.net archive, detailed the planned release of these critical security updates for Wednesday, October 21st, at 14:00 UTC (10:00 AM Eastern Time). The PHP security team, known for its meticulous approach to safeguarding the ecosystem, also dispatched a direct notification to its ANNOUNCE mailing list, a critical channel for disseminating vital security information to developers and administrators. The advisory explicitly warned of the possibility of an earlier release should details of either vulnerability become publicly accessible or if evidence of active exploitation in the wild emerged. This foresight proved prescient, as reports of such a leak began to surface.
Details surrounding the nature of these vulnerabilities, including specific affected PHP versions, potential exploitation vectors, and the exact versions that will contain the fixes, have not yet been officially disclosed by the PHP development team. This information is typically held under strict embargo until the release of patches to prevent malicious actors from exploiting the flaws before legitimate users can secure their systems.
However, insights from the cybersecurity firm watchTowr have provided crucial, albeit unofficial, details. Security researchers at watchTowr informed BleepingComputer that the vulnerabilities, now designated as CVE-2026-109618 and CVE-2026-109619, are classified as remote code execution (RCE) flaws. These types of vulnerabilities are particularly dangerous as they can allow an attacker to execute arbitrary code on a target server, potentially leading to complete system compromise, data theft, or the deployment of malware. watchTowr’s analysis suggests these critical issues may affect a broad spectrum of PHP versions, spanning from PHP 5 through PHP 8.
Benjamin Harris, CEO of watchTowr, elaborated on the situation, stating, "In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET." He further emphasized the severity, noting, "While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8."
The discrepancy between watchTowr’s assessment of "CVSS10" (which typically refers to CVSS v3.x scores of 10.0, the highest possible) and the PHP security team’s official "CVSS v4.0 score of 9.2" is noteworthy. While both indicate critical severity, the newer CVSS v4.0 system introduces more nuanced scoring, and a 9.2 is still within the "Critical" severity band. This difference might reflect updated analysis or a slight divergence in scoring methodologies, but the consensus remains that these are extremely serious security flaws.
Furthermore, watchTowr indicated that its team believes it has successfully reproduced the mechanics of CVE-2026-109618. However, in line with responsible disclosure practices, they are withholding the technical details of this reproduction until security patches become widely available. This commitment to responsible disclosure, even in the face of an information leak, is a cornerstone of modern cybersecurity.
Crucially, despite the reported leak of information, watchTowr clarified that they have not yet observed any evidence of these vulnerabilities being actively exploited "in the wild." This is a critical distinction, as it suggests that while the knowledge of the flaws is spreading, malicious actors may not yet be weaponizing them on a large scale. This window of opportunity, however small, is precisely what the emergency patching aims to close.
The origins of the leak appear to stem from discussions on public forums. A post on Y Combinator’s Hacker News forum, attributed to a user named "petecooper," claimed that two critical PHP remote code execution vulnerabilities were slated for disclosure on October 22nd. This post, which has since been deleted, also specified CVSS scores of 10.0 and indicated that the vulnerabilities affected PHP versions dating back to PHP 5. Importantly, the post identified the vulnerabilities using the same CVE identifiers, CVE-2026-109618 and CVE-2026-109619, that watchTowr later shared, lending significant credibility to the report of a leak.
The timing of the official PHP announcement also presents a point of divergence from some of the leaked information. While watchTowr’s statements and the Hacker News post suggested an originally planned Thursday disclosure, PHP’s official advisory clearly states a Wednesday release. This discrepancy could be attributed to the leak itself prompting an accelerated release schedule or simply a misunderstanding of the embargoed timeline by those outside the immediate disclosure process.
Chronology of Events and Advisories
The unfolding situation can be pieced together through a series of advisories and reports:
- Pre-Leak Embargo Period: The PHP security team had been working on identifying and preparing patches for two critical RCE vulnerabilities, with a planned disclosure date under strict embargo.
- Information Leak: Reports emerge, including a now-deleted post on Hacker News by user "petecooper" and subsequent confirmation from watchTowr, indicating that details about two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP versions 5 through 8 have been leaked. These leaks suggest a high CVSS score (reported as 10.0) and a planned disclosure on Thursday.
- PHP Official Advisory (Tuesday): The PHP development team publishes an advisory on Tuesday, announcing the upcoming release of security updates on Wednesday, October 21st, at 14:00 UTC (10:00 AM Eastern). They assign a CVSS v4.0 score of 9.2 to each vulnerability and warn of an earlier release if details become public or exploitation is detected.
- watchTowr Confirmation (Tuesday/Wednesday): watchTowr confirms the leak and the reality of the vulnerabilities to BleepingComputer, identifying them as RCE flaws affecting PHP 5-8 and reporting a CVSS score of "CVSS10". They state their belief in having reproduced one of the vulnerabilities but withhold details.
- Urgent Administrator Notification: The PHP security team sends direct notifications to its ANNOUNCE mailing list, urging administrators to prepare for immediate patching upon release.
- Official Patch Release (Wednesday): The PHP security team is scheduled to release the official patches and accompanying technical details.
Supporting Data and Context
PHP’s dominance in the web development landscape is a critical factor in understanding the potential impact of these vulnerabilities. According to W3Techs, PHP is used by 77.4% of all websites whose server-side programming language we know. This staggering figure underscores the widespread exposure. When critical vulnerabilities are discovered in such a widely used technology, the implications are far-reaching:
- Large Attack Surface: Millions of websites and web applications are potentially vulnerable.
- Economic Impact: Compromised e-commerce sites can lead to financial losses for businesses and individuals through fraud and data breaches.
- Reputational Damage: Websites and organizations suffering breaches face significant damage to their credibility and customer trust.
- Infrastructure Risk: Compromised web servers can be used as pivot points for larger network attacks or to host malicious content.
The CVSS v4.0 scoring system, while still in its relatively early stages of adoption, aims to provide a more nuanced and context-aware assessment of vulnerability severity. A score of 9.2 signifies a "Critical" rating, indicating that the vulnerability, if exploited, could lead to widespread, severe damage. Remote Code Execution (RCE) vulnerabilities are at the apex of exploit severity because they grant attackers direct control over the affected system, bypassing most conventional security measures.
The fact that these vulnerabilities are believed to affect versions 5, 6, 7, and 8 means that even older, potentially unmaintained, or less frequently updated PHP installations are at risk. This broad compatibility highlights the challenge for administrators who may be managing diverse and heterogeneous environments.
Official Responses and Calls to Action
The PHP security team’s swift advisory and call for emergency patching demonstrate a proactive approach to mitigating potential damage. Their explicit mention of releasing updates "earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild" underscores the gravity of the situation and their commitment to rapid response.
The ANNOUNCE mailing list serves as a vital communication channel for system administrators and developers who rely on timely security information. By directly notifying this group, the PHP security team aims to ensure that those responsible for securing servers are alerted and prepared to act as soon as the patches are available.
While the PHP team has not yet released specific technical details, their commitment to publishing "full technical details, affected versions, and fixed releases when the security updates become available" is standard practice and crucial for post-patch verification and understanding.
Broader Impact and Implications
The leak of these vulnerabilities ahead of their scheduled disclosure introduces an element of uncertainty and heightened risk. While watchTowr has not observed active exploitation, the mere existence of leaked information can accelerate the development of exploit tools by malicious actors. This creates a race against time for administrators to patch their systems.
The scenario also highlights the persistent challenges in maintaining security in open-source ecosystems. While transparency is a strength, it also means that sensitive security information can, and sometimes does, fall into the wrong hands. The PHP security team’s preparedness to accelerate their release schedule in response to such leaks is a testament to their robust incident response capabilities.
For administrators, the immediate implication is clear: monitor the official PHP security channels closely and be prepared to apply updates as soon as they are released. This may involve scheduling downtime, coordinating with development teams, and ensuring proper backup procedures are in place before applying patches. The potential for RCE means that the consequences of not patching could range from website defacement to complete system compromise and data exfiltration.
The differing CVSS scores reported by watchTowr and the PHP team, while both indicating critical severity, also warrant attention. As the industry transitions to CVSS v4.0, understanding these scoring differences will become increasingly important. However, for the immediate purpose of patching, the consensus on extreme severity is the paramount concern.
In conclusion, the PHP community is on high alert as the threat of two critical RCE vulnerabilities looms. The proactive warnings from the PHP security team, coupled with intelligence from cybersecurity firms, underscore the urgent need for administrators to prepare for emergency updates. The rapid dissemination of information, even if leaked, necessitates a swift and coordinated response to protect the vast digital infrastructure powered by PHP. The coming hours and days will be critical in determining the extent to which these vulnerabilities are exploited and the effectiveness of the global patching effort.
