The PHP project has scheduled a security release fixing two critical vulnerabilities, each rated 9.2 under CVSS v4.0, for October 21 at 14:00 UTC. Information about the flaws leaked on October 20, ahead of the coordinated disclosure, and CERT-EU’s advisory identifies them as CVE-2026-109618 and CVE-2026-109619.
The vulnerabilities are in PHP itself rather than in any one application, and the affected versions will only be published with the release. For hosting providers, the PHP team’s request to prepare therefore covers every PHP deployment they run.
Key facts
- Earlier release possible: the PHP team reserves the right to publish before 14:00 UTC if details become public or active exploitation appears.
- Supported branches: PHP 8.2 through 8.5 are supported. PHP 8.1 and earlier have reached end of life.
- CERT-EU advice: identify PHP applications, prepare to patch immediately, and consider isolating internet-facing applications where patching is not feasible.
- Past rounds: in the last two PHP security rounds, updates appeared within a day at CloudLinux alt-php (PHP 8.2 took 7 days in July), after 6 days at cPanel, 1 day at Debian 13 and 4 days at Plesk.
The Notice, the Leak and CERT-EU’s Advisory
The PHP project’s notice of October 20 encourages all PHP users to prepare so they can upgrade as soon as the release is available. Full details, affected versions and fixed versions will be published with the release. The team may release the fixes earlier if details of either vulnerability become public or if evidence of active exploitation appears in the wild.
On the same day, security researcher Kevin Beaumont posted at 16:39 UTC that someone had leaked the two CVEs before the patch was out. In a post about two hours later, security firm watchTowr stated that information on the embargoed remote code execution flaws had leaked, that it could confirm they are real, and that it could not share more.
CERT-EU, the cybersecurity service for EU institutions, has issued an advisory. According to CERT-EU, no technical details have been made public, and the 9.2 scores indicate the potential for unauthenticated remote code execution.
Which PHP Branches Are Supported
The support calendar on php.net lists four branches that currently receive fixes. PHP 8.4 and 8.5 are in active support, while PHP 8.2 and 8.3 receive security fixes only, until December 31, 2026, and December 31, 2027, respectively. Earlier branches, including PHP 8.1, have reached end of life, a status the project describes as leaving users possibly exposed to unpatched security vulnerabilities. Distributions can still patch branches that have reached end of life upstream: Ubuntu’s security notice of October 19, for example, updated php8.1 on Ubuntu 22.04 LTS.
What CERT-EU and Patchstack Advise
CERT-EU advises organizations to identify PHP-based applications and prepare to patch as soon as fixed versions are out. Where immediate patching is not feasible, it suggests considering isolating internet-facing applications from public networks until a fix can be applied.
Patchstack, a security company that works with hosting providers, suggests finding every PHP installation in use, including servers, containers and staging sites, and asking about upgrade options for any end-of-life version. It also advises customers on managed hosting to ask their host when the update will be applied, and warns against unofficial “fix” plugins and copied code snippets, which are unverified and can break a site.
How Fast Previous PHP Fixes Reached Hosting Platforms
The most recent security round, on September 24, brought PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34. Once php.net publishes fixed versions, hosts that rely on a control panel or a distribution receive them through that vendor’s packages. In that round and the one on July 30, the updated versions appeared in the vendors’ change logs and security announcements on these dates:
| Platform | Round of September 24 | Round of July 30 |
|---|---|---|
| CloudLinux alt-php | September 24 (same day) | July 31 (1 day), PHP 8.2 on August 6 |
| cPanel EasyApache 4 | September 30 (6 days) | August 5 (6 days) |
| Debian 13 (php8.4) | September 25 (1 day) | July 31 (1 day) |
| Plesk | September 28 (4 days) | August 3 (4 days) |
In both rounds, cPanel and Plesk each shipped all four supported branches, PHP 8.2 through 8.5, in a single update. These dates reflect vendor-published package updates, not when individual hosting providers installed them, and previous intervals do not predict how quickly vendors will respond to this release.
Sources
- Upcoming Critical PHP Security Release - PHP
- Critical Vulnerabilities in PHP (Security Advisory 2026-018) - CERT-EU
- Major security alert: PHP vulnerable to critical RCE, attacks ongoing - Patchstack
- Post by Kevin Beaumont - Mastodon (cyberplace.social)
- Post by watchTowr - X
- Supported Versions - PHP
- USN-8936-1: PHP vulnerabilities - Ubuntu
- Releases - PHP
- CloudLinux Changelog - CloudLinux
- Security Information - Debian
- Plesk Obsidian Change Log - Plesk
- EasyApache 4 Change Log - cPanel