The PHP security team has issued an urgent warning over two critical vulnerabilities affecting the widely used programming language, with emergency security updates scheduled for Wednesday, October 21. Both vulnerabilities carry a severity rating of 9.2 under the Common Vulnerability Scoring System (CVSS v4.0), placing them among the most serious security threats. PHP developers are urging website administrators and hosting providers to prepare for immediate updates once the patches become available.

The vulnerabilities, identified by security researchers as CVE-2026-109618 and CVE-2026-109619, have reportedly been classified as remote code execution flaws. Such vulnerabilities can potentially allow attackers to execute malicious commands on affected servers without authorized access, creating opportunities to steal sensitive information, alter website content or compromise underlying systems. However, PHP developers have not yet disclosed the technical conditions required to exploit either vulnerability.

Cybersecurity firm watchTowr has confirmed the reported vulnerabilities are genuine and indicated that they may affect PHP versions dating back to PHP 5. Researchers also reported successfully reproducing one of the vulnerabilities, although technical details are being withheld until security updates become available. The PHP security team has not independently confirmed which versions are affected, leaving the full extent of the potential exposure uncertain.

The warning follows reports that information about the vulnerabilities leaked ahead of a coordinated security disclosure originally expected on October 22. PHP developers subsequently announced a security release scheduled for October 21 at 14:00 UTC, or 10:00 a.m. Eastern Time. The development team has also warned that patches could be released earlier if technical details become public or evidence of active exploitation emerges.

PHP is used extensively across the internet, supporting websites, content management systems and commercial platforms, including WordPress, Drupal and numerous e-commerce applications. A vulnerability affecting its core components could therefore have consequences extending across multiple industries and hosting environments. Nevertheless, the presence of PHP on a website does not automatically establish that the website can be compromised, as actual exposure depends on the affected versions and exploitation requirements.

As of October 20, security researchers have reported no confirmed exploitation of the vulnerabilities in the wild. There is also no verified estimate of how many websites or servers may be exposed. The absence of reported attacks does not eliminate the threat, particularly if additional technical information becomes available before administrators can deploy security updates.

Organizations operating PHP-based applications are being advised to identify affected installations, review their exposure to public networks and prepare to install the forthcoming patches immediately. Administrators unable to apply updates promptly may need to consider temporarily restricting access to vulnerable services until remediation is possible. PHP developers are expected to publish full technical details, affected versions and available fixes alongside Wednesday's security release.