Global – October 27, 2026 -- PHP will ship an emergency patch for two critical core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Wednesday, October 21, 2026, at 14:00 UTC (10:00 ET). The PHP security team rates both flaws CVSS v4.0 9.2, and researchers describe them as unauthenticated remote code execution.
PHP reserves the right to release before 14:00 UTC
The project may ship earlier if technical details go public or exploitation appears in the wild, according to BleepingComputer. The official advisory names no vulnerable function, no affected versions and no fixed releases.
The CVE IDs, the "PHP 5 through 8" scope and the CVSS 10 figures come from researchers and a leak, not from PHP. Until the release, everything outside the official advisory remains theory.
Disabling unused file uploads cuts attack surface at no cost
It is unknown whether file uploads are involved. For PHP applications that never accept uploads, the recommended precaution is setting file_uploads = Off in php.ini, then reloading PHP-FPM or the web server. The change is cheap and counts as good hygiene regardless of the CVEs.
Leaked "PHP2Shell" screenshot raises malware risk for security teams
Sansec reported that a screenshot of an exploit tool called "PHP2Shell" leaked alongside the advisory. Purported exploits and scanners for the CVEs are expected on GitHub and Telegram before PHP publishes anything.
Pre-disclosure proof-of-concept code for heavily hyped bugs is a known route for delivering malware to security teams, and it can create false confidence. The advice is to wait for the official fix.
OX research team will analyze the official diff after release
Once PHP publishes the patch, the OX research team plans to break down the official diff, covering what changed, which versions are affected and how to tell whether a system is exposed. Until then, organizations should line up their PHP runtime owners so they can patch the moment the release lands.