Leaked Details Reveal Two Critical PHP Remote Code Execution Vulnerabilities

Summary

Details of two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, leaked before patches were available. PHP scheduled an emergency release; affected versions remain unconfirmed, and Huntress reported no observed exploitation.

Key points

PHP rates both vulnerabilities critical, with CVSS v4.0 scores of 9.2; public reporting describes them as remote code execution flaws.
PHP scheduled an emergency security release for October 21, 2026, but affected and fixed versions had not yet been announced.
Reports suggest PHP versions 5 through 8 may be affected, while fixes may be limited to supported branches; this was not confirmed by PHP.
Huntress said it had not seen in-the-wild exploitation in its partner environments as of publication; no confirmed IOCs or public exploit code were known.
Organizations were advised to inventory PHP installations, prioritize internet-facing systems for patching, and isolate or upgrade end-of-life PHP environments.
For interim monitoring, the article recommends alerting on PHP worker processes that spawn shells, interpreters, or download tools.

Article Details

Vulnerability Types: Remote code execution
Severity: Critical; CVSS v4.0 9.2 for both vulnerabilities
Exploitation Status: not_reported
Exploit Availability: unknown
Patch Status: unavailable
Workarounds: Upgrade, take end-of-life PHP environments off the internet, or put them behind a VPN or web application firewall until fixes are available.