System administrators and security teams worldwide are preparing for an imminent round of critical updates after the PHP security team published an advance notice detailing two high-severity vulnerabilities in the ubiquitous web programming language.
The two flaws, which create the potential for remote code execution, could allow malicious actors to orchestrate website takeovers, compromise stored data, and enforce unauthorized redirects. The vulnerabilities have been assigned the identifiers CVE-2026-109618 and CVE-2026-109619, with members of the cybersecurity research community dubbing the pair php2shell.
Embargo Breach Forces Advance Advisory
The unusual advance notification came after confidential details regarding the vulnerabilities were leaked ahead of an agreed-upon disclosure timeline. The premature disclosure originated from an alias identified as petecooper on Y Combinator’s Hacker News platform. While that post was subsequently deleted, reports indicated that the user claimed PHP would disclose two remote code execution flaws affecting versions dating back to PHP 5, asserting that both vulnerabilities carried maximum CVSS scores of 10.0.
Security industry professionals who possessed prior knowledge under embargo responded as the news began circulating publicly. Florian Roth, Head of Research at Nextron Systems, noted on X that an RCE vulnerability in PHP core had leaked, adding that details were initially slated for release on October 20 and indicating that only PHP 8 will receive official security patches.
Faced with the public circulation of the vulnerability identifiers and descriptions, the PHP security team notified its ANNOUNCE mailing list and issued a formal pre-release advisory to enable administrators to prepare their deployment pipelines ahead of the official release.
Official Timeline and Severity Ratings
According to the official advisory from the PHP security team, the scheduled release is set for Wednesday, 21 October 2026 at 14:00 UTC. While leaked forum posts and external researchers initially described the bugs as holding a CVSS 10.0 severity rating, the official advisory rates both vulnerabilities under CVSS v4.0 at 9.2.
The PHP security team emphasized that users must prepare to deploy patches immediately upon availability, noting that the release could be pushed forward if conditions deteriorate. The team stated that it reserves the right to release the update earlier if detailed technical information emerges publicly or if defenders discover evidence of active exploitation in the wild. Comprehensive disclosures, including verified lists of affected versions and patched releases, will accompany the official rollout.
Independent Verification and Technical Impact
Cybersecurity firm watchTowr confirmed the legitimacy of the disclosures. Chief Executive Officer Benjamin Harris stated that the two remote code execution vulnerabilities were originally scheduled for coordinated disclosure under embargo. Harris confirmed that while sensitive technical specifics remain withheld to safeguard server environments, the vulnerabilities are verified, carry CVSS 10 ratings in their assessment, and are understood to impact PHP versions 5, 6, 7, and 8.
Researchers at watchTowr also confirmed that they successfully reproduced the exploitation path for CVE-2026-109618 in testing environments, proving that the underlying flaw is functional. Despite the reproduction of the exploit by researchers, there have been no confirmed reports of threat actors deploying the flaws as zero-days against live production environments. Administrators operating PHP infrastructure are advised to monitor official channels and apply the forthcoming releases as soon as they become available.
