Given that PHP—an open-source scripting language driving dynamic web pages and applications—powers roughly 69% of all websites, any major security flaw spells trouble. Discovering two critical security vulnerabilities at once multiplies the risk significantly. Complicating matters further, a proof of concept has already surfaced ahead of the official fix, alongside warnings that malicious actors are actively scanning servers for exploitation routes. Fortunately, a corrective patch is scheduled for release today, October 21, at 10 AM Eastern. Cybersecurity professionals strongly advise all web administrators running PHP to update immediately, emphasizing that exploitation is both remote and straightforward.

Critical New PHP Security Vulnerabilities Confirmed

PHP.net has officially acknowledged the dual vulnerabilities, withholding deeper technical specifics for now. Security researchers indicate these flaws will receive the designations CVE-2026-109618 and CVE-2026-109619, both classified as remote code execution bugs. While unconfirmed by PHP.net directly, reports suggest that PHP versions 5, 6, 7, and 8 are all affected. Meanwhile, the organization noted that comprehensive specifics, impacted builds, and patched editions will accompany the official rollout.

Oliver Spence, CEO of CybaVerse, explained that with vulnerability details already leaked, threat actors will concentrate their efforts on PHP, aware that these two critical remote code execution CVEs could facilitate deeper network breaches and subsequent ransomware deployments.

Daniel Wilcock, threat intelligence analyst at Talion, reinforced this assessment, stating that because these represent severe remote code execution flaws, numerous web servers, content management systems, and e-commerce platforms utilizing PHP face immediate exposure. He added that enterprises will scramble to deploy the patches the moment they become accessible.

PHP Warning: Patch Today, Patch Quickly

The primary imperative is to secure PHP installations without delay, provided administrators have the means to do so. This action should be executed as swiftly as possible following the update's arrival. Nevertheless, the Detectify Security Research team cautions that remediation may prove challenging. Older versions present the gravest danger because they lack ongoing support; only PHP 8.2 and later will receive official patches. Sites running unmaintained legacy versions over multiple years often suffer from a complete lack of active oversight.

Administrators can utilize complimentary tools to perform a preliminary assessment of their exposure levels, though such scans offer no absolute guarantee of safety. Ultimately, the singular definitive defense is to execute an immediate system update.