PHP Schedules Emergency Patch for Two Critical RCE Flaws on October 21st

The PHP security team announced an emergency release scheduled for Wednesday, October 21 at 14:00 UTC to address two critical vulnerabilities rated CVSS v4.0 9.2 by remote code execution (RCE) capabilities. Security researchers from watchTowr confirmed the flaws are real and tracked as CVE-2026-109618 and CVE-2026-109619, affecting PHP versions ranging from 5 to 8. Although technical details regarding exploitation methods remain undisclosed due to sensitivity concerns, administrators were urged to prepare for immediate upgrades upon the release of affected and fixed versions.