PHP warns of two critical flaws, emergency patches due October 21

The PHP security team warned administrators about two critical vulnerabilities rated 9.2 under CVSS v4.0 and will release emergency updates on October 21 at 14:00 UTC. According to watchTowr, the flaws are RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP 5, 6, 7 and 8, with details reportedly leaking ahead of disclosure.

• Both vulnerabilities rated 9.2 under CVSS v4.0
• Security updates scheduled for October 21 at 14:00 UTC
• watchTowr: RCE flaws affect PHP 5, 6, 7 and 8
• Technical details withheld until patches ship