Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches.
Key takeaways
- CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities.
- watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging.
- The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes.
Background
Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026.
FAQ
When were these PHP vulnerabilities first disclosed?
On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr, the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo.
A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.— The PHP Foundation (@ThePHPF) October 20, 2026
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
— The PHP Foundation (@ThePHPF) October 20, 2026
What are CVE-2026-109618 and CVE-2026-109619?
CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release.
CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory.
Which PHP versions are affected?
CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions:
Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories.
How widespread is PHP, and how many hosts are potentially affected?
According to W3Techs, PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP.
Has exploitation been observed in the wild?
On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its mitigations as new attack vectors appear. watchTowr told BleepingComputer it believes it has reproduced CVE-2026-109618.
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.We are seeing early attacks emerging and are updating mitigations as new vectors show up.This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.— Dane Knecht 🦭 (@dok2001) October 21, 2026
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
— Dane Knecht 🦭 (@dok2001) October 21, 2026
Is there a proof-of-concept (PoC) available?
Code claiming to exploit these vulnerabilities is circulating publicly, but we have not verified that any of it works against CVE-2026-109618 or CVE-2026-109619. Unverified exploit code is sometimes laced with malware, so treat it with caution.
Are patches or mitigations available?
Not yet. Patches are scheduled for release on October 21, 2026 at 14:00 UTC (10:00 AM ET). The expected fixed versions are listed in the table above. End-of-life PHP branches are not expected to receive official fixes.
PHP core developer Gina Peter Banyard said that "the only mitigation is patching / upgrading PHP." Responding to a suggestion that included turning off session upload progress, a PHP configuration setting, PHP 8.6 release manager Joe Ferguson said that "ini settings won't save you."
Other steps can reduce exposure until you can patch, but none of them replaces the fix. Where immediate patching is not feasible, CERT-EU recommends that organizations consider isolating internet-facing applications from public networks until a fix is available.
Cloudflare has deployed WAF rules for the known exploit vectors, available to all customers including the free tier. Cloudflare describes this as a stopgap only. The rules only cover traffic routed through Cloudflare.
Have PHP vulnerabilities been exploited before?
Yes. The CISA Known Exploited Vulnerabilities (KEV) catalog includes three vulnerabilities in PHP itself. Two of them are known to have been used in ransomware campaigns:
The third, CVE-2012-1823, is a PHP-CGI flaw that CVE-2024-4577 later bypassed.
Has Tenable released any product coverage for these vulnerabilities?
The following Tenable plugins are available to identify PHP installations and unsupported versions on affected systems:
A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages for CVE-2026-109618 and CVE-2026-109619 as they're released. These links will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.
Get more information
- PHP Foundation on X: Advance notice of upcoming security release
Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
