Two PHP vulnerabilities carry a 9.2 out of 10 CVSS rating, and CERT-EU says organisations unable to patch quickly should consider isolating exposed applications. The PHP project has scheduled fixes for 14:00 UTC on Wednesday, October 21. No attacks have been confirmed so far, but the vulnerabilities may allow unauthenticated remote code execution.
How did the vulnerabilities come to light?
CERT-EU issued its advice in an advisory published Tuesday evening, after claims about the flaws spread online on Monday. The PHP security team moved the planned release forward by a day, according to the source material. It also said the release could happen sooner if details became public or attacks began.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP security team assigned each a 9.2 out of 10 on CVSS, a scale used to describe the severity of security bugs. CERT-EU said that rating indicates a risk of remote code execution without authentication.
What does remote code execution mean?
It means an attacker could send instructions to a server over the internet and have the server run them without a password or login. The source does not say that this has happened in these cases. The Australian Cyber Security Centre (ACSC) also said it was not aware of active exploitation related to the vulnerabilities.
PHP runs on web servers and supports pages on sites built with WordPress, Drupal, Joomla and Magento. That means organisations may need to check applications behind their websites, not just the pages visitors see. The source says PHP has not yet identified which versions are vulnerable or which releases will contain the fixes.
What should organisations prepare?
CERT-EU told organisations to identify every PHP application they run and prepare to patch them all at once. The PHP security team advised users to prepare ahead of release and upgrade as soon as the update is available. The source says the project is expected to provide version details with the patches.
- The flaws are identified as CVE-2026-109618 and CVE-2026-109619.
- The PHP security team rated them 9.2 out of 10 on CVSS.
- The planned release time is 14:00 UTC on Wednesday, October 21.
- CERT-EU says organisations unable to patch should consider isolating internet-facing applications.
What remains unknown before release?
CERT-EU said every PHP version from PHP 5 onwards could be affected, but the source notes that this assessment drew on social media posts rather than confirmation from PHP. The PHP project has not yet stated which versions are vulnerable. It has also not identified the releases that will address the flaws.
The source reports that researchers at watchTowr reproduced one bug, according to Huntress, but it provides no further technical details. GoDaddy warned that exploitation could expose data, alter websites or give attackers control of servers. Those outcomes are warnings, not confirmed incidents in the supplied reporting.
Organisations can use the planned release to check their PHP inventory and prepare updates. If they cannot apply a fix quickly, CERT-EU’s advice is to consider taking sites offline or isolating internet-facing applications. The next concrete information is expected with the PHP patches.