Critical PHP Security Flaws Leak, Triggering Emergency Patch Warning for Millions of Website — Apply Emergency Patch Today

Millions of websites could face serious security risks after details of two critical PHP vulnerabilities leaked ahead of their planned disclosure, prompting an emergency patch announcement and urgent warnings to website administrators worldwide.

The PHP security team confirmed Tuesday that it would release emergency security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each carrying a severity score of 9.2 under the CVSS v4.0 system.

The warning has sent website operators and cybersecurity teams scrambling to prepare for fixes. PHP is one of the internet’s most widely used server-side programming languages, supporting everything from WordPress websites and online stores to enterprise applications.

The concern goes beyond the vulnerabilities themselves. Security researchers say details surfaced online before the coordinated disclosure, potentially giving attackers a head start before website owners can install patches.

In its official security advisory, the PHP development team urged administrators to prepare immediately.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the team said.

“We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

Leaked PHP vulnerabilities could let hackers take control of websites

The two vulnerabilities, identified by security researchers as CVE-2026-109618 and CVE-2026-109619, are believed to be remote code execution (RCE) flaws.

That classification is particularly troubling. Successful exploitation of an RCE vulnerability can let an attacker run malicious instructions on a remote server, potentially leading to stolen data, compromised applications, unauthorized access, or a complete server takeover.

Cybersecurity firm watchTowr confirmed the vulnerabilities after information about them appeared online ahead of schedule.

“In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET,” watchTowr CEO Benjamin Harris told BleepingComputer.

“While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8.”

That assessment differs from PHP’s official severity rating of 9.2. The PHP security team has not yet publicly confirmed the affected versions or disclosed the technical conditions required for exploitation.

PHP 6 was never released as a stable production version, making the reported version range another reason to await the official technical advisory.

watchTowr said it believes it successfully reproduced CVE-2026-109618 but is withholding technical details ahead of the security fixes.

The disclosure has attracted attention from infrastructure providers. Cloudflare CTO Dane Knecht has reported early signs of attacks, according to Tenable’s security analysis.

The reported activity raises the stakes for administrators, though the full scale of exploitation remains unclear.

Why millions of PHP-powered websites could be at risk

PHP’s reach makes this warning unusually significant. The language sits behind major content management systems, including WordPress, Drupal, and Joomla, along with countless custom applications and e-commerce services.

A serious vulnerability in PHP can affect the underlying server environment, not just a single plugin or website feature.

For website operators, that distinction matters. Updating WordPress, installing a plugin patch, or changing a website password does not necessarily resolve a vulnerability in the PHP runtime itself.

The greater concern is older PHP installations.

Security researchers warn that unsupported PHP versions may never receive fixes for these vulnerabilities. According to Tenable, emergency updates are expected for supported PHP 8.x branches, leaving organizations running outdated versions facing more complicated security decisions.

Administrators should identify which PHP versions their servers use, prepare backups, coordinate with hosting providers, and install the official security releases as soon as they become available.

Organizations unable to patch vulnerable systems may need temporary protective measures, including restricting public access to affected services until upgrades are possible.

The PHP team has said it will disclose the full technical details, affected versions, and corrected releases alongside the security updates.

For now, one distinction remains important: PHP’s widespread use does not mean every PHP-powered website is confirmed vulnerable. The precise exposure depends on technical details that have yet to be officially published.

Still, the combination of leaked vulnerability information, possible remote code execution, and an enormous installed base creates a dangerous window for website operators.

The immediate priority is clear: identify PHP deployments, watch the official PHP security announcements, and be ready to apply the emergency fixes.

For millions of websites built on PHP, the next security update could be one of the year’s most consequential.