Website admins across the world bracing for impact following major PHP flaw reveal

PHP discloses two critical remote code execution vulnerabilities that could enable website takeover and data theft Details leaked before patch release, prompting an early security advisory and urgent upgrade warning Researchers confirmed the flaws are real, with widespread impact expected across multiple PHP versions PHP, arguably the most popular programming language for websites and web applications in the world, contains two critical-level vulnerabilities that could expose countless sites to remote code execution (RCE) attacks, the provider has revealed.

The flaws could lead to website takeovers, data theft, malicious redirects, and a whole swathe of similarly sinister situations.

Security rush hour PHP published a new security advisory, giving admins a “heads up” on an incoming patch.

“The PHP security team would like to give advance notice of an upcoming security release,” the advisory reads.

“It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.Full details, affected versions, and the fixed versions will be published with the release.” If you’re thinking the announcement is rather unorthodox and that PHP might as well just released the patch - you’re absolutely right.

The problem is that someone spilled the beans on the vulnerabilities before the official embargo was lifted, having the cybersecurity community scrambling for answers.

That ‘someone’ is a person with an alias ‘petecooper’, who published a new post on Y Combinator’s Hacker News forum earlier this week.

In the post, they claimed PHP would disclose two remote code execution bugs on October 22 2026.

The post has since been deleted so we couldn’t independently verify it, but BleepingComputer says the post claimed the bugs carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5.

The post also labeled the bugs as CVE-2026-109618 and CVE-2026-109619, which was subsequently confirmed.

Therefore, the only thing that’s wrong is the CVSS score which seems to be 9.2, not 10.0.