A lot of websites were going offline until the patches could be applied if they used a vulnerable PHP version. My WordPress Docker image was updated this morning, but looks like another will be ready in about 10 minutes. Seems like the vulnerabilities were leaked a day early, but why is it being fixed so late?
By Lawrence Abrams
Update 10/21/26: Added update to the end of this article.
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services.
In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0.
The PHP security team also sent a notice to its ANNOUNCE mailing list, urging administrators to prepare to install the security updates as soon as they become available.
“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” the PHP security team warned.
The developers have not disclosed any technical details about the vulnerabilities, including which PHP versions are affected, how they can be exploited, or which releases will contain fixes.
However, security researchers at watchTowr told BleepingComputer that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution (RCE) flaws believed to affect PHP versions 5, 6, 7, and 8.
“In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET,” watchTowr CEO Benjamin Harris told BleepingComputer.
“While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8.”
watchTowr also said it believes it has successfully reproduced CVE-2026-109618 but is not releasing technical information until security patches become available.
The researchers clarified that they have not observed exploitation of the vulnerabilities in the wild, despite the information reportedly leaking ahead of the planned disclosure.
In a post on X, watchTowr warned that information about the vulnerabilities had leaked before the originally planned disclosure date.
“We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they’re real,” the researchers said.
The warning follows a now-deleted post on Y Combinator’s Hacker News forum, in which a user named “petecooper” claimed that two critical PHP remote code execution vulnerabilities would be disclosed on October 22.
The post, seen by BleepingComputer, claimed that both vulnerabilities carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5.
It also identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, matching the identifiers watchTowr later shared.
However, watchTowr’s statements and the Hacker News post are different from PHP’s official announcement. Both described the vulnerabilities as CVSS 10.0, while the PHP security team assigned each a CVSS v4.0 score of 9.2.
Additionally, watchTowr cited an originally planned Thursday disclosure, while PHP has officially scheduled its security release for tomorrow morning.
The PHP security team says it will publish full technical details, affected versions, and fixed releases when the security updates become available.
Update October 21: Cloudflare has released an emergency update to its managed Web Application Firewall (WAF) ruleset to help protect customers against the upcoming PHP vulnerabilities, which researchers have begun referring to as “PHP2SHELL.”
Cloudflare CTO Dane Knecht confirmed on X that the company has already deployed an initial set of WAF rules designed to block known exploitation methods for the vulnerabilities. These protections are available to all Cloudflare customers, including those on free plans.
Knecht also warned that Cloudflare is already observing early attacks and is updating its mitigations as new exploitation techniques emerge.
However, he stressed that these protections are only temporary measures and urged administrators to install the official PHP security updates as soon as they become available at 14:00 UTC today.
Meanwhile, cybersecurity researchers have suggested additional potential mitigations for organizations unable to immediately patch their PHP installations.
These include disabling PHP’s session upload progress feature and blocking HTTP requests that use the ‘multipart/form-data’ content type.
To disable the session upload progress feature, you can add the following directive to your PHP.ini and restart your web server daemon:
session.upload_progress.enabled = OffIt should be noted that blocking multipart requests can significantly disrupt website functionality, including preventing visitors from submitting forms and uploading files.
These suggested mitigations have not been verified to prevent exploitation of the vulnerabilities, and we are sharing them only as potential mitigation for administrators unable to immediately patch their systems.
However, PHP core developer Gina Peter Banyard has warned on Mastodon that no mitigations exist for the vulnerabilities and that applying the official security patches is the only solution.
Administrators should therefore treat all proposed workarounds and WAF protections as temporary measures rather than replacements for installing the PHP security updates.