PHP ships urgent security patch for two critical RCE flaws

PHP will ship an out-of-cycle security update at 14:00 UTC on October 21 to address two critical remote code execution vulnerabilities, rated 9.2 on the CVSS v4.0 scale, according to an advance notice. The flaws, which security researchers at watchTowr confirmed can allow remote code execution, were first disclosed via a post on Hacker News on October 20.

The leak included two CVE identifiers, CVE-2026-109618 and CVE-2026-109619, though PHP‘s notice did not name them. watchTowr later stated that the scope of affected versions “has not been confirmed by an official vendor advisory.” Only the four supported branches—8.2 through 8.5—can receive the fix, and no exploitation has been reported so far.

Researchers at Huntress noted they had not seen exploitation in partner environments and were not aware of public exploit code, yet past incidents like CVE-2024-4577 saw exploit attempts within 24 hours. PHP has published no workaround, so administrators should prepare to patch immediately and isolate internet-facing applications where needed, as advised by CERT-EU.

✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.

Previous Articles:

• SpaceX Q3 Profit $4.4B, Revenue Beats Estimates
• OpenAI Acquires Orchestra Bio to Boost Drug Development AI
• Strive raises $630M in SATS IPO for Bitcoin buys
• FortiSIEM Critical Path Traversal Flaw Now Has PoC Exploit
• Zcash Leads Crypto Rebound With 8.5% Surge to $1,215