PHP's Critical RCE Flaws: Patch Day and Proof-of-Concept

Episode 1 · PHP Core Hit by Critical RCE Flaws, Emergency Patch Set for October 21 (2026-10-21, 10 posts)

The PHP security team has announced an emergency security update on October 21, 2026 at 14:00 UTC, fixing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both officially rated CVSS v4.0 9.2. Details have already leaked, and the patch may be released early if in-the-wild exploitation or further leaks occur. This is a high-severity event affecting the PHP core, and all PHP users should prepare upgrades in advance.

Confirmed

• The PHP security team will release an emergency security update on October 21, 2026 at 14:00 UTC, fixing two critical vulnerabilities rated CVSS v4.0 9.2 (consistently reported across posts by jedisct1, taylorotwell, DynamicWebPaige, and others)
• The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619, and details have already leaked (per DynamicWebPaige, who noted watchTowr is already active)
• Security researcher cyb3rops revealed that one is a maximum-severity CVSS 10.0 RCE flaw in the PHP core, and that only the PHP 8 series will receive patches; older versions are expected to go unfixed
• Laravel creator Taylor Otwell said Laravel will urgently adapt across the board and urged all PHP users to prepare upgrades in advance
• cyb3rops recommended container isolation plus tight monitoring to limit potential damage before the patch, and released an open-source eBPF tool for detecting exploitation early

Unconfirmed

• There is a discrepancy between the official 9.2 rating and cyb3rops's claim of CVSS 10.0 for a single vulnerability; the basis for the max rating has not been officially confirmed
• cyb3rops repeatedly mentioned that vulnerability details would be disclosed on October 20; the relationship to the official October 21 patch date awaits clarification
• No evidence of in-the-wild exploitation so far

Why it matters

• The flaws sit in the PHP core with ratings up to CVSS 10.0 and could theoretically allow remote arbitrary code execution, affecting a huge number of PHP sites
• Patches only for PHP 8 mean users of older versions have nothing to patch and may be forced into a major-version upgrade
• Details have already leaked, so exploitation could appear quickly around the patch release; ops teams should complete upgrade plans, isolation, and monitoring preparations before October 21

• CVSS 10.0 RCE vulnerability disclosed in PHP core, patches only for PHP 8 — cyb3rops · 2026-10-21
• CVSS 10.0 RCE in PHP core: critical patches land Oct 21, PHP 8 only — cyb3rops · 2026-10-21
• PHP core RCE rated CVSS 10.0 lands Oct 20; eBPF tool spots exploitation early — cyb3rops · 2026-10-21
• PHP pre-announces critical security release fixing two CVSS 9.2 vulnerabilities on Oct 21 — jedisct1 · 2026-10-21
• Two CVSS 9.2 Critical PHP Vulnerabilities Land Tomorrow; Laravel Scrambles to Patch — taylorotwell · 2026-10-21
• PHP remote control vulnerability hits back to PHP 5, agents poised to weaponize it fast — MarcJSchmidt · 2026-10-21
• PHP rushes emergency patches as info on two RCE flaws (rated up to CVSS 10) leaks early — DynamicWebPaige · 2026-10-21
• Two PHP CVEs incoming, warning that '70.2% of the internet' will be scrambling — JiliJeanlouis · 2026-10-21
• PHP to issue urgent fix for two CVSS 9.2 flaws amid RCE exploit concerns — _jaydeepkarale · 2026-10-21
• Critical PHP RCE Leaked Before Patch, Fueling Fears of Open-Source AI Regulation — basedjensen · 2026-10-21

Episode 2 · PHP RCE proof-of-concept confirmed working, but not one-click (2026-10-21, 2 posts)

Security researchers confirmed the leaked PHP RCE proof-of-concept is genuine and usable, though exploitation requires certain preconditions. Combined with the vulnerability's high severity rating, the situation remains concerning.

• PHP RCE proof-of-concept confirmed working, exploitation not trivial but concerning — realmrfakename · 2026-10-21
• Researcher confirms PHP RCE proof-of-concept works, though not trivial to exploit — realmrfakename · 2026-10-21