PHP schedules an emergency release for two critical RCE flaws

PHP’s security team announced on 20 October that it will ship an out-of-band security release fixing two critical vulnerabilities, both rated CVSS v4.0 9.2. The release is scheduled for 14:00 UTC today, 21 October.

The announcement itself is the unusual part: PHP rarely pre-announces a release time before the fix is ready. The team has not published CVE numbers, affected versions or any technical detail, saying only that it reserves the right to ship earlier “if details of either vulnerability become public, or if we see evidence of active exploitation in the wild.” Security researchers have since linked the pair to CVE-2026-109618 and CVE-2026-109619 based on a leak, but PHP itself has confirmed none of that, and as of writing the official changelog shows no new release yet.

Why it matters: PHP still runs most of the server-side web, so a CVSS 9.2 pair from the language’s own security team is worth clearing time for. Watch php.net today and update as soon as a build is out, rather than waiting for the usual changelog read-through.

The caveat: nothing is confirmed to patch yet. This is advance notice of a date and a severity, not an advisory with a fix attached.