Critical flaws strike PHP as disclosure embargo is broken

The maintainers of the PHP general purpose scripting language are telling users to prepare to update their systems with patches for two critical vulnerabilities.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. and PHP rates them as 9.2 out of 10 possible in terms of severity, with patches expected overnight Australian time.

News of the vulnerabilities broke early, before the embargo on them had expired.

A poster on the Hacker News site claimed two remote code execution vulnerabilities, or RCEs, in PHP would be announced on October 22 AEST, citing unnamed sources but quoting the CVE numbers.

Just hours after the existence of the two vulnerabilities surfaced on social media, a researcher posted the alleged full details of the vulnerabilities on the web, including two proofs of concept (PoCs).

iTnews has sighted the website but has not had independent confirmation that the PoCs are working ones.

On Wednesday, the Australian Signals Directorate (ASD) issued an unusual pre-patch alert about the vulnerabilities, urging administrators to monitor their PHP applications to be ready to update.

❗ ALERT ❗ We are aware of media reporting about critical vulnerabilities in PHP that may affect all versions from PHP 5 onwards. Organisations and individuals should monitor PHP applications and prepare to update and apply patches. Read the full alert https://t.co/XNcE4W0Wtj https://t.co/Zwqndc3iHu

— Australian Signals Directorate (@ASDGovAu) October 21, 2026

In Europe, CERT-EU, the cyber security service for EU institutions, issued an advisory telling organisations to prepare for immediate patching.

Where patching isn’t feasible, CERT-EU said organisations should “consider isolating internet-facing applications from public networks until a fix is available”.

PHP powers very popular server-side web applications such as the WordPress and Drupal content management systems, and the Magento ecommerce platform, running on millions of sites worldwide.

This story will be updated when official technical details of the vulnerabilities and patching advice is available.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts