Website admins across the world bracing for impact following major PHP flaw reveal

Date:
Wed, 21 Oct 2026 15:36:33 +0000

Description:
PHP notifies the community of two critical RCE flaws, says patch is coming imminently.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter PHP discloses two critical remote code execution vulnerabilities that could enable website takeover and data theft Details leaked before patch release, prompting an early security advisory and urgent upgrade warning Researchers confirmed the flaws are real, with widespread impact expected across multiple PHP versions PHP, arguably
the most popular programming language for websites and web applications in
the world, contains two critical-level vulnerabilities that could expose countless sites to remote code execution (RCE) attacks, the provider has revealed.

The flaws could lead to website takeovers, data theft, malicious redirects, and a whole swathe of similarly sinister situations. Security rush hour PHP published a new security advisory, giving admins a heads up on an incoming patch. Latest Videos From TechRadar Watch full video here:

The PHP security team would like to give advance notice of an upcoming security release, the advisory reads.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.Full details, affected versions, and the fixed versions will be published with the release. You may like Hackers are targeting a critical WordPress flaw, so be on your guard Third-party WooCommerce plugin hits WordPress sites with PHP backdoor abusing recently patched vulnerability Two major security flaws are affecting more than six million WordPress websites

If youre thinking the announcement is rather unorthodox and that PHP might as well just released the patch - youre absolutely right. The problem is that someone spilled the beans on the vulnerabilities before the official embargo was lifted, having the cybersecurity community scrambling for answers.

That someone is a person with an alias petecooper, who published a new post
on Y Combinators Hacker News forum earlier this week. In the post, they claimed PHP would disclose two remote code execution bugs on October 22 2026. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

The post has since been deleted so we couldnt independently verify it, but BleepingComputer says the post claimed the bugs carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5.

The post also labeled the bugs as CVE-2026-109618 and CVE-2026-109619, which was subsequently confirmed. Therefore, the only thing thats wrong is the CVSS score which seems to be 9.2, not 10.0.

Among the people who knew about the flaw and the upcoming patch were watchTowr, and Florian Roth, Head of Research at Nextron Systems. What to
read next Citrix says two worrying NetScaler RCE zero-days exploited in attacks Linux users beware CISA flags three major security issues you need
to patch right now A potentially dangerous macOS security flaw went
unreported due to Apple being deluged by AI slop bug reports

The embargo on the news was set for October 20, with the patch due a day later, on October 21. However, yesterday Roth posted on X, saying Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches. Leaking the zero-days This forced PHPs hand, not just to release the advisory, but also to send a notice to its ANNOUNCE mailing list, according
to BleepingComputer .

Security researchers watchTowr confirmed the news, saying the bugs are
tracked as CVE-2026-109618 and CVE-2026-109619, and that the duo is being nicknamed php2shell by the community. Obviously, technical details are being withheld to protect users, but most likely affect PHP versions 5, 6, 7, and
8.

"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," watchTowr CEO Benjamin Harris told BleepingComputer .

"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood
to affect PHP versions 5, 6, 7, and 8."

The researchers also told the publication they managed to successfully reproduce CVE-2026-109618, confirming the flaws actually work. Good news is, there are still no confirmed reports of the flaws being used as zero-days in the wild. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/website-admins-across-the-world-bracing -for-impact-following-major-php-flaw-reveal


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)