Which PHP Versions Get Emergency Patch for Unconfirmed 9.2 RCE Vulnerabilities?

The short version

• The PHP security team scheduled an out-of-cycle release for Wednesday, 21 October 2026, at 14:00 UTC.
• Two vulnerabilities are rated 9.2 under CVSS v4.0, but no CVE IDs or technical specifics have been published.
• watchTowr researchers claim the flaws enable remote code execution, though PHP has not confirmed this scope.

The details

The PHP security team published a warning on 20 October 2026 regarding two critical vulnerabilities, each carrying a CVSS v4.0 score of 9.2, according to GBHackers. The official update is set for 14:00 UTC on 21 October, with maintainers noting they may accelerate the release if exploitation evidence emerges.

While watchTowr researchers have identified the issues as potential remote code execution flaws, PHP has not confirmed the technical nature or identifiers of the bugs. The vendor stated that full details, including affected versions and fixed releases, will accompany the patch. Until then, administrators lack confirmed information on attack vectors, authentication requirements, or specific configuration prerequisites that might expose their systems.

The context

Security researchers at watchTowr have associated the reported issues with CVE-2026-109618 and CVE-2026-109619, though PHP has not linked these IDs to the 9.2 scores, according to The Hacker News. A prior leak suggested a broader impact from PHP 5 onwards with a CVSS 10.0 rating, but the vendor has not verified this scope. Only the four currently supported branches, 8.2 through 8.5, will receive the fix. Older versions, including 8.1 and below, are end of life and will not get vendor patches. This follows earlier reporting on critical configuration risks in Unblu Spark, highlighting the need for strict version management.

Next steps

• Monitor official PHP channels for the confirmed release and technical advisories.
• Identify all servers running PHP branches 8.2 through 8.5 for prioritisation.
• Prepare deployment pipelines to apply the out-of-cycle update immediately upon release.
• Verify that older, unsupported PHP versions are isolated or migrated to mitigate risk.

What defenders should look for

Teams usually check web server access logs for unusual request patterns or unexpected command execution indicators. Defenders should monitor for outbound connections from web servers to unknown external IPs, which may signal data exfiltration or command-and-control activity. Application performance monitoring tools can reveal sudden spikes in resource usage or abnormal process spawning. If anomalies appear, isolate the affected host immediately to prevent lateral movement. Review firewall logs for suspicious traffic and preserve forensic artefacts before remediation.

What to do and how to stay safe: PHP

• Inventory all systems running PHP to determine which fall within the supported 8.2-8.5 range.
• Ensure change management processes are ready for an emergency patch deployment.
• Monitor network traffic for signs of remote code execution or unusual outbound connections.
• Once the vendor provides an update, test it in a staging environment before production rollout.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions will receive the security patch?

Only PHP branches 8.2, 8.3, 8.4, and 8.5 are supported and will receive the fix.

Have the CVE IDs for these vulnerabilities been confirmed?

No, PHP has not confirmed the identifiers or linked them to the 9.2 CVSS scores.

Is there evidence of active exploitation in the wild?

watchTowr reported no known exploitation as of 21 October, but this does not rule it out.