PHP warns it plans to release 2 emergency patches imminently

Live updates

1. 1h ago

   PHP Issues Emergency Patches for Critical Vulnerabilities

   PHP maintainers released two emergency security patches to address critical remote code execution vulnerabilities affecting PHP versions 5.4 and later. The flaws, designated as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2, triggered an urgent security alert across the internet. An EU agency warned that websites might need to be taken offline while administrators apply the fixes or deploy mitigations. The vulnerabilities require specific knowledge of the target server to exploit, but have prompted emergency guidance from projects and cloud providers.

   Why it matters

   PHP is a widespread general-purpose scripting language powering a vast portion of the internet, making widespread vulnerabilities exceptionally dangerous. The discovery of these critical remote code execution flaws forced rapid coordination among security teams, platform maintainers, and infrastructure providers. Organizations rushed to apply patches or utilize edge defenses like web application firewalls to block potential zero-day exploitation.

   What is confirmed

   • PHP released two emergency patches on October 21, 2026, to fix remote code execution bugs affecting PHP 5.4 and later.
   • The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 with a CVSS score of 9.2.
   • An EU agency warned that websites may need to be taken offline as PHP prepared patches for the vulnerabilities.

   Still unconfirmed

   • An unconfirmed report claims the PHP2Shell exploit remotely executes code on PHP sites.

   What to watch next

   • Adoption rates of the October 21 emergency patches across web servers
   • Further advisories from cybersecurity agencies regarding active exploitation of CVE-2026-109618 and CVE-2026-109619
   Sources used for this update (13)

   1. help.naver.com — Futures Flat As Oil Rebounds After Trump's "Energy Ceasefire" Unravels, Memory Stocks Slide | ZeroHedge
   2. Ars Technica — PHP warns it plans to release 2 emergency patches imminently
   3. Reuters — EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities
   4. The Hacker News — PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
   5. Yahoo Tech — What to know about critical PHP vulnerability threatening Internet
   6. Laravel News — Critical PHP Security Release Coming Tomorrow (October 21)
   7. arstechnica.com — PHP warns it plans to release 2 emergency patches imminently - Ars Technica
   8. community.spiceworks.com — Critical PHP Security Release - 21 October 2026 - "PHP2Shell" exploit - Software & Applications - Spiceworks Community
   9. sansec.io — Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619 | Sansec
   10. forum.hifiguides.com — Bad Guy Good Audio 4/4 (The Final Chapter) - IEMs / Other / In-Ear Monitors (IEM) - HifiGuides Forums
   11. builder.aws.com — Buying Time: Using AWS WAF to Defend Against Zero-Days Before the Patch Lands | AWS Builder Center
   12. www.zdnet.com — PHP2Shell: Haven’t patched yet? Take these steps now to mitigate
   confidence 100%