Wisevoter
World

Critical PHP Remote Code Execution Flaws Leak Online

Information regarding two severe vulnerabilities surfaced ahead of an official security patch release.

Updated on Oct. 20, 2026 in Cybersecurity

Isometric editorial illustration of a monolithic server rack structure with geometric data pathways, representing critical software security vulnerabilities.
Critical remote code execution vulnerabilities in PHP have been disclosed, leaving older software versions vulnerable to potential exploitation before security patches arrive. AI Illustration. Upload story photo >

Live Poll

Do you trust that the websites you visit are effectively protected against critical security vulnerabilities?

Details concerning two critical remote code execution vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, leaked prematurely on Hacker News. Security firm watchTowr has since confirmed the existence of these high-severity flaws.

Why it matters

The vulnerabilities pose a significant security risk, as they reportedly carry a maximum CVSS score of 10.0 and affect PHP versions dating back to PHP 5. Because only PHP 8 versions are set to receive official security updates, users on older software face potential exposure.

The two identified remote code execution vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both flaws carry a maximum CVSS severity score of 10.0 and impact PHP software versions ranging from PHP 5 to current iterations.

The players

watchTowr

This is a security research firm that confirmed the validity of the leaked PHP vulnerabilities.

The details

The leak originated from a post on Hacker News, which was later removed, though screenshots of the technical details continued to circulate on platforms including X and Mastodon. Security researchers are now focusing on the upcoming patch rollout to mitigate potential exploitation of the affected versions.

Timeline

  1. September 24, 2026: The latest standard security releases for PHP were shipped.

  2. October 20, 2026: Information regarding the vulnerabilities leaked on Hacker News.

  3. October 22, 2026: Official patches and security advisories are scheduled for release.

The Tech Race

This incident underscores the fragility of the open-source software supply chain and the risks inherent in the PHP 8 legacy support lifecycle. It highlights how premature disclosures force an accelerated response cycle for maintainers against potential exploitation.

Users running versions of PHP older than version 8 should prepare for limited mitigation options as official patches will not be backported to older legacy software. Administrators must plan to update their systems to the latest PHP 8 versions to remain protected.

The takeaway

Security professionals recommend that organizations audit their PHP environments immediately to identify affected versions. Proactive patching remains the most effective defense against remote code execution risks following the premature public leak.

What happens next

Official security patches and advisories for the identified PHP vulnerabilities are scheduled for public release on October 22, 2026.

Further reading

For more information on current digital threats, see the latest updates on Cybersecurity.

Live Poll

Do you trust that the websites you visit are effectively protected against critical security vulnerabilities?