Will your PHP servers survive the leaked RCE flaws hitting Oct 21?
Emergency patches for two critical remote code execution flaws in PHP are due tomorrow after details leaked early.
Key points
- Two critical RCE flaws in PHP 5 through 8 are confirmed real by watchTowr
- Patches are scheduled for 14:00 UTC on 21 October 2026
- Affected versions include PHP 5, 6, 7, and 8 across many web applications
The short version
- PHP maintainers warn of two 9.2 CVSS severity remote code execution flaws
- Details leaked before the scheduled embargo lift on 21 October 2026
- watchTowr confirms the flaws affect PHP versions 5 through 8
The details
The PHP security team issued an advisory on Tuesday stating that emergency updates would be released on Wednesday, 21 October, at 14:00 UTC. The team warned administrators to prepare for immediate installation as information about the vulnerabilities had reportedly leaked ahead of the scheduled disclosure. The advisory noted that the developers reserve the right to release fixes earlier if details become public or evidence of active exploitation appears. Both flaws are rated 9.2 under CVSS v4.0, indicating severe potential impact.
Security researchers at watchTowr confirmed the vulnerabilities are genuine remote code execution flaws. Tracked as CVE-2026-109618 and CVE-2026-109619, these issues affect PHP versions 5, 6, 7, and 8. watchTowr stated it had successfully reproduced CVE-2026-109618 but withheld technical details until patches are available. The firm also confirmed it has not observed exploitation in the wild despite the early leak of information.
View the original post on X
The context
Ars Technica reported that unverified claims circulated showing a tool dubbed PHP2Shell executing code on servers running various applications. These included WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. The report suggested the flaws impact every PHP version from 2004 onward.
Other security firms responded to the developing situation. Sansec researchers stated they expected mass attacks to begin shortly after the patch release. Webfence and Huntress also issued advisories urging administrators to prepare maintenance windows. One researcher estimated approximately 1.3 million internet-connected hosts might be affected by these widespread vulnerabilities.
Next steps
Administrators should identify all systems running PHP versions 5 through 8 within their environment. Teams need to plan maintenance windows starting at 14:00 UTC on 21 October, with contingencies for earlier releases. Backing up site and database files before applying updates is recommended. Monitoring the PHP.net homepage for late-breaking announcements regarding release times is also essential.
What defenders should look for
Teams should monitor web server logs for unusual request patterns or unexpected process spawning from web-facing services. Look for outbound connections from web servers to unfamiliar IP addresses or domains, which may indicate command and control activity. Check for new user accounts or privilege escalations on affected systems. If suspicious activity is detected, isolate the compromised server from the network immediately. Review firewall rules to block unauthorized outbound traffic while maintaining logging capabilities for forensic analysis.
What to do and how to stay safe: PHP
- Inventory all servers and applications running PHP versions 5 through 8 to assess exposure.
- Schedule maintenance windows for 14:00 UTC on 21 October and prepare for earlier patching.
- Back up all site files and databases before applying any emergency updates.
- Monitor official PHP channels for announcements regarding earlier release times or new details.
Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by these remote code execution flaws?
watchTowr confirms the flaws affect PHP versions 5, 6, 7, and 8.
When will the patches for CVE-2026-109618 and CVE-2026-109619 be released?
Patches are scheduled for 14:00 UTC on 21 October 2026, though an earlier release is possible.
Has there been any confirmed exploitation of these flaws in the wild?
watchTowr stated it has not observed exploitation of the vulnerabilities in the wild.
