# PHP pre-announces two critical RCE flaws in PHP core (CVE-2026-109618, CVE-2026-109619); emergency patches due 2026-10-21 after embargo leak

> The PHP security team pre-announced two critical remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 by PHP, with emergency fixes scheduled for 2026-10-21 14:00 UTC. Details leaked ahead of the embargo through a since-deleted Hacker News post, and watchTowr says it reproduced CVE-2026-109618 but is withholding technical details. No in-the-wild exploitation had been reported at publication.

- **Published:** 2026-10-20T22:08:44Z
- **Last reviewed:** 2026-10-22T10:25:06.784Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3989
- **ID:** TL-2026-3989
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 159 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-109618, CVE-2026-109619

## Description

On 2026-10-20 the PHP project published an advance security notice on php.net stating that two critical vulnerabilities, both scored CVSS v4.0 9.2, would be fixed in a security release on Wednesday 2026-10-21 at 14:00 UTC (10:00 AM ET). The notice deliberately omits affected and fixed versions ("Full details, affected versions, and the fixed versions will be published with the release") and reserves the right to release earlier "should details of either vulnerability become public, or should evidence of active exploitation appear in the wild". The release had originally been planned for 2026-10-22.

Information about the flaws leaked before the embargo lifted via a Hacker News post (item 50167754, user petecooper, since deleted) and social-media posts. watchTowr CEO Benjamin Harris stated that both flaws are "CVSS10" in the leaked reporting (versus PHP's own 9.2) and "are understood to affect PHP versions 5, 6, 7, and 8"; watchTowr said it successfully reproduced CVE-2026-109618 but will not share technical information until patches ship. Neither the vulnerability class beyond 'remote code execution', the CWE, the attack vector, nor the trigger conditions have been disclosed. No public proof of concept, technical write-up, CISA KEV listing, or in-the-wild exploitation was reported as of 2026-10-21.

Third-party reporting (Mallory, ThreatCluster) says PHP 5.x and 7.x are end-of-life and will not receive patches, and Mallory reports the planned fixed versions as PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; these version numbers are NOT confirmed by the PHP advisory and should be validated against the official release notes. Mallory's internet-exposure estimate is roughly 884,000 internet-facing hosts running PHP versions that will not be fixed (about 59% of ~1.5 million hosts reporting a PHP version): PHP 5.x 368,570 hosts, PHP 7.x 329,358 hosts, PHP 8.0-8.1 185,789 hosts, against 612,269 hosts on patchable 8.2-8.5. Because PHP underpins a very large share of web applications, exploitation of a core RCE would likely be rapid once a patch diff or write-up becomes available, so defenders should inventory PHP versions, prepare patch pipelines, and increase monitoring of web-server worker processes and web-root file writes. This record reflects pre-patch intelligence and must be updated when the official release notes publish.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Web Shell
- T1595.002 Vulnerability Scanning
- T1588.006 Vulnerabilities
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.006 Command and Scripting Interpreter: Python
- T1105 Ingress Tool Transfer
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1587.004 Develop Capabilities
- T1053.003 Scheduled Task/Job: Cron
- T1071.001 Application Layer Protocol: Web Protocols
- T1136.001 Create Account: Local Account
- T1203 Exploitation for Client Execution
- T1588.005 Obtain Capabilities: Exploits
- T1499 Endpoint Denial of Service
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1212 Exploitation for Credential Access
- T1136 Create Account
- T1027 Obfuscated Files or Information
- T1041 Exfiltration Over C2 Channel
- T1592.002 Gather Victim Host Information: Software
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1095 Non-Application Layer Protocol
- T1005 Data from Local System
- T1204.002 User Execution: Malicious File
- T1552 Unsecured Credentials
- T1583.001 Acquire Infrastructure
- T1573.001 Encrypted Channel
- T1498 Network Denial of Service
- T1595 Active Scanning
- T1090 Proxy

## Sources

- [PHP warns admins of two critical flaws, emergency patches coming tomorrow](https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/)
- [PHP.net news archive - security release pre-announcement](https://www.php.net/archive/2026.php#2026-10-20-1)
- [PHP Remote Code Execution FAQ: CVE-2026-109618 & CVE-2026-109619 (watchTowr)](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/)
- [PHP Core RCEs CVE-2026-109618 and CVE-2026-109619 Leak Early (Threat Landscape)](https://threatlandscape.io/blog/php-core-rce-cve-2026-109618-109619-leak-ahead-of-embargo)
- [PHP Remote Code Execution (RCE): 884K Hosts Get No Fix (Mallory)](https://mallory.ai/blog/php-rce-rapid-response)
- [watchTowr statement on X](https://x.com/watchtowrcyber/status/2112611507749982605)
- [NVD entry for CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3989