Website administrators around the world brace for impact after major PHP flaw is revealed
follow us
Add us as a preferred source on Google
- PHP Reveals Two Critical Remote Code Execution Vulnerabilities That Could Allow Website Takeover and Data Theft
- Details were leaked before the patch was released, prompting an early security advisory and urgent update warning.
- The researchers confirmed that the flaws are real and a widespread impact is expected across multiple versions of PHP.
PHP, arguably the world’s most popular programming language for websites and web applications, contains two critical-level vulnerabilities that could expose countless sites to remote code execution (RCE) attacks, the vendor revealed.
Flaws could lead to website takeovers, data theft, malicious redirects, and a whole host of other equally sinister situations.
security rush hour
PHP released a new security advisory, alerting administrators of an incoming patch.
Latest videos ofTechnologyRadar
“The PHP security team would like to provide advance notice of an upcoming security release,” the notice reads.
“It is scheduled for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are advised to prepare now to be able to update as soon as the release is available. We reserve the right to publish sooner if details of any of the vulnerabilities become public or if evidence of active exploitation appears in the wild. Full details, affected versions, and versions corrected versions will be published with the release.”
If you think the announcement is unorthodox and that PHP could have released the patch, you are absolutely right. The problem is that someone counted the vulnerabilities before the official embargo was lifted, leaving the cybersecurity community searching for answers.
That “someone” is a person with an alias “petecooper,” who published a new post on Y Combinator’s Hacker News forum earlier this week. In the post, they stated that PHP would reveal two remote code execution bugs on October 22, 2026.
The post has since been deleted, so we couldn’t independently verify it, but beepcomputer says the post claimed the bugs had CVSS scores of 10.0 and affected PHP versions dating back to PHP 5.
The post also labeled the bugs as CVE-2026-109618 and CVE-2026-109619, which was later confirmed. Therefore, the only bad thing is the CVSS score, which appears to be 9.2, not 10.0.
Among the people aware of the flaw and the upcoming patch were watchTowr and Florian Roth, head of research at Nextron Systems.
The news embargo has been set for October 20, and the patch expires a day later on October 21. However, yesterday Roth posted on
Filtering zero days
This forced PHP to not only publish the notice, but also send a notice to its ANNOUNCE mailing list, according to beepcomputer.
Security researchers watchTowr confirmed the news, saying that the bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and that the duo is nicknamed “php2shell” by the community. Obviously, the technical details are kept hidden to protect users, but they will most likely affect PHP versions 5, 6, 7, and 8.
“In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and were due to be released on Thursday at 11 a.m. ET,” said watchTowr CEO Benjamin Harris. beepcomputer.
“While we cannot share technical information at this time for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are real. Both are CVSS10 and are understood to affect PHP versions 5, 6, 7 and 8.”
The researchers also told the publication that they managed to successfully reproduce CVE-2026-109618, confirming that the flaws actually work. The good news is that there are still no confirmed reports of faults being used as zero days in the wild.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment