PHP rushes emergency patches as info on two RCE flaws (rated up to CVSS 10) leaks early
DynamicWebPaige · x · 2026-10-21
The PHP security team will ship emergency updates Wednesday at 14:00 UTC for two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) after details leaked ahead of embargo.
- watchTowr researchers rate the flaws CVSS 10.0 and confirm they are remote code execution (RCE) bugs
- Believed to affect PHP versions 5 through 8
- No known exploitation in the wild yet; PHP reserves the right to release patches earlier
- Admins running PHP-based sites and CMSes are urged to patch immediately once updates land
Officials have not disclosed technical details; watchTowr CEO Benjamin Harris confirmed the leak occurred roughly an hour before the advisory.
Related event: PHP Core Hit by CVSS 10.0 RCE Flaws, Emergency Patch Set for October 21(11 posts)→
More from Safety
- Paper claims ChatGPT silently builds psychological profiles of users, 96% of memories stored unasked — provenauthority · 2026-10-21
- Schmidt and Ferguson Argue China and the U.S. Are Building "Empires of AI" — marigo · 2026-10-21
- Protesters Demand AI Freeze Outside OpenAI's NYC Office; Analyst Sees Daily Protests by 2027 — LuizaJarovsky · 2026-10-21
- Compromised certs used to break into Xiaomi smart lights, firsthand test — basedjensen · 2026-10-21
- Sarah Archer: agent-found holes across the internet do feel like an AI problem — saranormous · 2026-10-21
- Polymarket opens book on OpenAI reporting another AI sandbox escape — Polymarket · 2026-10-21