The PHP security team is scrambling to release emergency patches a day earlier than planned after information about two critical vulnerabilities leaked ahead of their coordinated disclosure date.

In an advisory published Tuesday, PHP developers said they will ship security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern) to fix two flaws, each rated 9.2 under CVSS v4.0. The team also posted to its ANNOUNCE mailing list urging administrators to prepare to patch immediately once updates land.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” the PHP security team said.

PHP has not disclosed technical details, affected versions, or which releases will contain fixes. However, researchers at watchTowr told BleepingComputer the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs believed to affect PHP 5, 6, 7, and 8.

watchTowr CEO Benjamin Harris said the flaws were originally under embargo with a planned disclosure for Thursday at 11 AM ET, but leaked roughly an hour before his statement to BleepingComputer. “We can confirm that these vulnerabilities are indeed real,” Harris said, noting watchTowr believes it has reproduced CVE-2026-109618 but is withholding technical specifics until patches ship. The firm said it has not observed in-the-wild exploitation despite the leak.

Conflicting severity claims

The leak traces back to a now-deleted Hacker News post from a user called “petecooper,” which claimed the two RCE flaws would be disclosed October 22 and rated both CVSS 10.0, affecting versions back to PHP 5. The post cited the same CVE identifiers watchTowr later confirmed.

Notably, both watchTowr and the leaked post describe the flaws as CVSS 10.0, while PHP’s official advisory lists each at 9.2 under CVSS v4.0. watchTowr also referenced a Thursday disclosure date, while PHP’s official patch window is set for Wednesday morning.

What admins should do

  • Given that PHP powers a large share of websites, CMS platforms, and e-commerce systems, treat this as an urgent, unscheduled patch cycle.
  • Monitor the PHP security advisory page for the release of patched versions and technical details.
  • Prepare to patch as soon as updates are published, given the risk that public proof-of-concept code could follow the leak quickly.

PHP says it will publish full technical details, affected versions, and fixed releases once the security updates become available.