Threat Intelligence

Critical PHP Flaws Leaked Before Patches: What Businesses Should Do Now

Huntress · 21 Oct 2026

Key Takeaway Start inventorying all PHP installs now, including those inside third-party software, so you can patch immediately when fixes land and keep unsupported versions off the internet.

On October 20, details of two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before any fixes were available. A Hacker News post was taken down, but screenshots had already spread on social media. Security firm watchTowr confirmed the flaws are real and said it reproduced CVE-2026-109618. The PHP security team rates both as critical, with a CVSS v4.0 score of 9.2.

PHP has announced an emergency security release for Wednesday, October 21 at 14:00 UTC (10am ET), a day earlier than the original embargo. It says it may ship sooner if technical details become public or exploitation starts. Huntress reported it had not seen exploitation in the wild across its partner environments as of October 20.

The affected and fixed versions are not yet confirmed. Reporting suggests PHP versions 5 through 8 may be affected, and that only currently supported branches will receive a fix. If so, end-of-life PHP versions would stay exposed with no patch. Huntress advises organisations to list every PHP install they own, including those bundled inside vendor software, plan to patch the moment fixes arrive, and isolate end-of-life PHP from the internet.

PHP CVE-2026-109618 CVE-2026-109619 remote code execution vulnerability management

Summarised by CISO AI from Huntress, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.