The PHP security team announced an out-of-cycle release for Wednesday 21 October at 14:00 UTC to fix two vulnerabilities rated 9.2 on the CVSS v4.0 scale. Researchers at watchTowr say they are remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, believed to affect versions 5 through 8. Details had leaked before the planned disclosure, but no exploitation has been observed. Technical details and fixed releases will be published with the patches.

What it means: PHP runs behind a large part of the web, from WordPress and online shops to internal business applications, so two critical remote code execution flaws are among the worst scenarios administrators can face. The leak ahead of the planned date shortens the window: once fixes are published, attackers will compare the code and try to build an exploit within hours. IT teams should already have a list of every server running PHP, including container images and forgotten legacy applications. Anyone on shared hosting should ask their provider when it will apply the update. The biggest problem concerns versions that are no longer supported, such as PHP 5 or 7, which will probably get no official fix. There, the only safe options are upgrading or isolating the application behind a web application firewall. Until technical details are known, it makes sense to step up log monitoring for unusual requests. For Greek small businesses running an e-shop, this is the week to check that someone is genuinely responsible for applying updates.

Read the original on BleepingComputer

Related service: Custom software

Related stories