What PHP has officially confirmed
The official notice on php.net is brief. The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. That works out to 10:00 a.m. Eastern Daylight Time.
The project also says it may ship before then: "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." It is holding back the useful specifics for now. Full details, affected versions, and the fixed versions will be published with the release.
The same notice went to PHP's mailing lists. Posts on the PHP Foundation's Discourse mirror of php.announce say the team encourage all PHP users to prepare now so you can update as soon as it is available. PHP's public commit log shows the pre-announcement being added to the php.net site on Tue, 20 Oct 2026 19:26:49 +0000.
Summary: Two critical bugs, each rated CVSS v4.0 9.2. The release is set for October 21 at 14:00 UTC but could come sooner. PHP has not yet named affected versions or fixed builds.
The leak, and what researchers are saying
PHP rarely announces a release in advance like this. Here, the advance notice followed an embargo that appears to have broken early. BleepingComputer reports that watchTowr researchers identified the bugs as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution flaws thought to affect PHP versions 5, 6, 7 and 8. watchTowr CEO Benjamin Harris told the outlet that the vulnerabilities "are indeed real." He also said watchTowr believes it has reproduced CVE-2026-109618, but it is withholding technical details until patches ship. According to BleepingComputer, the researchers said they had not seen exploitation in the wild at the time they spoke.
watchTowr also warned publicly on X: "We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real." One small detail: that post wrote the identifiers as CVE-2926-109618/619, a typo for 2026, which is worth knowing if you're searching feeds for the CVE numbers.
The first public trace appears to be a now-deleted Hacker News post. Threat Landscape reports that the user petecooper cited a "reliable source" claiming an announcement covering two PHP RCEs with a CVSS score of 10.0 was scheduled for October 22, 2026, at 18:00 CEST. Threat Landscape also notes that both CVEs remain in reserved status with no public descriptions.
CERT-EU has published its own advisory. It says no technical details are currently available beyond the scores, and that the vulnerabilities could affect every PHP version from PHP 5 onward. That version claim is sourced to a social media post, not to PHP itself.
Conflicting numbers
Several claims are circulating that don't match each other:
Claim Official PHP position Leak / third-party reports Severity CVSS v4.0 9.2 each "CVSS 10" per watchTowr and the Hacker News post Disclosure timing Wed Oct 21, 14:00 UTC Thursday Oct 22, 11:00 a.m. ET Bug class Not stated Remote code execution Affected versions To be published with release PHP 5 through 8 Branches getting fixes To be published with release Disputed (see below)
There is a reason the "8.2 and later" figure sounds plausible. PHP's own front page lists recent security releases only on the 8.x branches: PHP 8.2.34 Released! The PHP development team announces the immediate availability of PHP 8.2.34. This is a security release. Others in the same run were PHP 8.5.11, PHP 8.3.35 and PHP 8.4.26, announced 08 Oct 2026. So 8.2 through 8.5 are the branches PHP is currently patching. Whether Wednesday's fixes cover anything older is for PHP to say.
One more point from general industry history: PHP 6 was abandoned before it ever shipped as a stable release, and the project went from 5.x to 7.0. When leak reports say "PHP 6," they probably mean "everything from the 5.x era onward," not a real production branch you need to look for.
Summary: PHP's 9.2 rating and Wednesday schedule are the figures to plan around. The 10.0 score, the RCE label and the 5-through-8 range are researcher and leak claims. Which branches get fixes is still unknown.
Why Windows admins should care
PHP isn't only a Linux concern. It runs on Windows Server under IIS through FastCGI, inside bundled local stacks that developers install and forget, in WordPress and Drupal deployments, and inside third-party vendor appliances and admin consoles. As the X summary puts it, PHP runs Wikipedia, WordPress sites, WooCommerce stores, Drupal sites and Adobe Commerce storefronts.
Ask yourself who installed PHP on each of your servers. If you don't know, that's the gap to close before Wednesday.
How to prepare before 14:00 UTC Wednesday
PHP hasn't published a workaround, so preparation comes down to inventory and readiness. The steps below are operational advice drawn from PHP's request to prepare and from CERT-EU's guidance. They are not instructions from PHP itself.
What success looks like: you have a complete list of PHP installs, each with a named owner, a known update route and a scheduled slot to deploy the fixed build. No exposed server should be running a PHP version nobody is responsible for.php -v on the command line shows the version of that particular binary. Web-served instances can use a different binary, so check what the web server actually loads.
The bigger picture
When an embargo breaks, everyone has less time. Defenders get the same warning attackers do, but neither side has full details yet. Once PHP publishes the fixes, people will diff the patched code within hours, which is how quiet patches turn into working exploits. Commentators are already predicting that, and the X summary claims security commentators expect exploitation within minutes of the details dropping. That is a prediction, not evidence, and as of the latest reporting nobody has confirmed exploitation in the wild.
To PHP's credit, it gave a specific time, an official score and an honest note that the date could move. The less comfortable part is the long tail of old PHP installs. If the fixes do skip end-of-life branches, sites still on PHP 7.4 will have nothing to install on Wednesday. Their only options will be upgrading or isolating those systems.
Watch for PHP's release notes at 14:00 UTC on Wednesday, or earlier if the team decides it can't wait.