The **PHP** development team has issued an urgent advisory, announcing that security updates will be released on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern). These patches aim to fix two critical vulnerabilities, each rated 9.2 under **CVSS v4.0**. In a notice to its ANNOUNCE mailing list, the **PHP** security team emphasized the need for administrators to be ready to install these updates as soon as they become available. The team also stated, "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." ### Details Emerge Ahead of Schedule While official technical details remain under wraps, security researchers at **watchTowr** have informed BleepingComputer that the vulnerabilities, identified as **CVE-2026-109618** and **CVE-2026-109619**, are remote code execution (RCE) flaws. These are believed to impact **PHP** versions 5, 6, 7, and 8. **watchTowr** CEO **Benjamin Harris** confirmed the leak: "In the last hour, two remote code execution vulnerabilities in **PHP** have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET." He added, "While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are **CVSS10** and are understood to affect **PHP** versions 5, 6, 7, and 8." **watchTowr** also stated they have successfully reproduced **CVE-2026-109618** but will withhold technical information until patches are publicly available. Despite the leak, no active exploitation in the wild has been observed by the researchers. ### Discrepancies in Disclosure News of the vulnerabilities first surfaced in a now-deleted post on **Y Combinator's Hacker News** forum. A user named "petecooper" claimed two critical **PHP** RCE vulnerabilities would be disclosed on October 22, both with **CVSS** scores of 10.0 and affecting **PHP** versions back to PHP 5. This post also cited **CVE-2026-109618** and **CVE-2026-109619**. It's worth noting a discrepancy between the unofficial reports and the official **PHP** announcement. Both **watchTowr** and the **Hacker News** post described the vulnerabilities as **CVSS 10.0**, while the **PHP** security team officially assigned a **CVSS v4.0** score of 9.2 to each. Additionally, **watchTowr** mentioned an originally planned Thursday disclosure, while **PHP** has now officially moved its release to Wednesday morning. ### What's Next? **PHP** powers a vast number of websites and web applications, including popular content management systems and e-commerce platforms. The widespread use of **PHP** means these RCE vulnerabilities could have a significant impact. When the security updates become available, the **PHP** security team has committed to publishing full technical details, including affected versions and fixed releases. System administrators and developers are strongly advised to monitor official **PHP** channels and apply the patches immediately upon release.