The PHP security team has issued advance warning of two critical vulnerabilities and scheduled an unusual coordinated security release for October 21, 2026, at 14:00 UTC. Both issues carry a CVSS 4.0 score of 9.2, giving hosting companies, application owners and incident-response teams only a short preparation window before technical details and patched builds become public.

PHP’s notice says the release could arrive earlier if information about either flaw leaks further or if defenders identify active exploitation. The project has not yet published the complete affected-version matrix, prerequisites or attack mechanics. That limited disclosure is deliberate: it gives operators time to prepare without providing attackers with a roadmap before fixes are available.

Remote code execution is reported, but details remain limited

Public reporting associates the flaws with CVE-2026-109618 and CVE-2026-109619. Security firm watchTowr and an advisory from CERT-EU describe possible unauthenticated remote code execution, an outcome that could let an external attacker run chosen commands on a vulnerable web server. However, PHP’s own advance notification does not name those identifiers or confirm precisely how exploitation would work.

Claims that every PHP release from version 5 onward is affected have also not been confirmed by the vendor. It remains unknown whether default installations are exposed, whether a particular extension or setting is necessary, and whether behavior differs across operating systems. Administrators should therefore avoid treating speculative configuration advice as a substitute for the official release notes.

The published vendor rating is 9.2 under CVSS 4.0, not the maximum 10.0 score seen in some early discussion. That distinction does not make the flaws routine: PHP powers a vast range of public websites, content-management systems and business applications, so a remotely reachable vulnerability can create a large patching race even when exploitation requires specific conditions.

No confirmed attacks at the time of warning

At the time of the advance notice, watchTowr reported no known exploitation in the wild. PHP’s willingness to accelerate the release is a precaution and should not be read as proof that systems have already been attacked. Likewise, leaked demonstrations or proof-of-concept claims do not by themselves establish successful intrusions against real organizations.

Past PHP incidents explain the urgency. Attempts to exploit CVE-2024-4577 were observed within roughly a day of its disclosure. That older issue is separate from the new pair, as are PHP SOAP extension vulnerabilities fixed earlier in 2026, but both examples show how quickly public technical information can be operationalized.

Prepare the deployment pipeline now

Teams do not need to wait for exploit details to reduce response time. They can identify the owners, dependencies and update path for every PHP runtime before fixed packages land.

• Inventory internet-facing servers, containers, appliances and managed applications that embed PHP.
• Confirm which team or hosting provider controls each runtime and how version changes reach production.
• Prepare backups, rollback procedures and a small representative test set for urgent validation.
• Monitor the official PHP release channel for the affected-version list and fixed builds.
• Where rapid patching is impossible, assess whether exposed applications can be temporarily isolated without unacceptable business impact.

After deploying the update, administrators should verify the version used by the running web service rather than trusting a package-manager result alone. Multiple PHP installations, stale containers or a service that was not restarted can leave the vulnerable interpreter active. External scanning and application health checks can help confirm that the intended build is serving requests.

Until the advisory is complete, the most useful response is disciplined readiness: avoid guessing about immunity, document exceptions, and prioritize publicly reachable systems. Once PHP releases authoritative details, defenders can refine exposure assessments and detection rules using facts instead of early claims.