Affected Systems
PHP versions 5, 6, 7, and 8 (all major versions). CVE-2026-109618 and CVE-2026-109619. Affects websites, CMS platforms, e-commerce systems, and custom web applications running PHP.
Exploitation Status
No active exploitation observed. Vulnerability details leaked ahead of embargo. watchTowr researchers claim successful reproduction of CVE-2026-109618. PoC not publicly released but leak increases imminent exploitation risk.
Business Impact
Remote code execution vulnerabilities affecting all major PHP versions represent critical risk to web infrastructure. CVSS v4.0 score of 9.2 (PHP official) vs. CVSS 10.0 (researcher claims) indicates maximum severity. Premature leak increases window for weaponization before patches deploy. PHP powers significant portion of web applications globally, making exposure surface extremely large.
Urgency
🔴 Immediate
Recommended Actions
- Prepare to apply PHP security updates immediately upon release October 21, 2026 at 14:00 UTC (10:00 AM ET)
- Inventory all PHP installations across infrastructure to identify affected versions 5.x through 8.x
- Review web application firewall (WAF) rules and enable aggressive blocking for suspicious PHP execution patterns
- Monitor PHP security team announcements at php.net and ANNOUNCE mailing list for early release or technical details
- Establish emergency change control process to expedite patching within hours of release given leak and RCE severity