The PHP project will publish an out-of-band security release on 21 October at 14:00 UTC for two vulnerabilities it rates 9.2 under CVSS v4.0. The release was pulled forward after details leaked out of embargo.
What happened
PHP's security team issued a pre-announcement on 20 October: two flaws in PHP core, both 9.2, with fixes on 21 October at 14:00 UTC. The team reserved the right to ship earlier if details went public or exploitation appeared.
Details did go public. watchTowr confirmed the identifiers in circulation, CVE-2026-109618 and CVE-2026-109619, and said it reproduced the first. Both records are still reserved in the CVE dictionary at the time of writing, which means the authoritative description, affected branches and fixed versions only exist once PHP publishes them alongside the release.
Public reporting, including CERT-EU advisory 2026-018, describes both as remote code execution reachable without authentication, on PHP versions from PHP 5 onward. watchTowr has called them CVSS 10; PHP's own figure is 9.2. No exploitation in the wild has been reported. Sansec expects mass scanning within minutes of the patch going live.
Who is affected
Anything that runs PHP: WordPress, Joomla, Drupal, Magento, Laravel, MediaWiki, WHMCS, and the long tail of custom line-of-business applications. Only PHP 8 is still supported, and only PHP 8 will get a fix.
- Sites and apps pinned to PHP 7.x or 5.x, which will not receive a patch at all.
- VPS, dedicated and on-premise servers where the business controls its own PHP build.
- Shared hosting where the provider controls the version and the customer sees nothing.
- Internal intranets, old CRMs and tools built by a contractor who has since moved on.
What to do now
Establish which PHP version every site and application runs before 14:00 UTC, then patch within hours of the fix landing, not days.
- Ask your host in writing whether PHP is auto-patched, and which branch each site is pinned to.
- On servers you own, list versions now with
php -vper pool. - Take a snapshot or image before applying the update, so a broken extension is a rollback and not a rebuild.
- After patching, review access logs for the exposure window and check upload directories for new files.
- Anything still on PHP 5 or 7 needs a migration decision this week, because no patch is coming for it.
What this means for South African businesses
Most SA SMEs do not run PHP themselves. Their sites sit on shared hosting or with an agency, so the patch is someone else's job and the business will not be told when it happens. The exposure concentrates on the sites nobody owns any more: the old brochure site, the staff intranet, the quoting tool built in 2019.
My read is that the real risk in the first 48 hours is commodity scanning against unpatched shared-hosting accounts, which is precisely the population that never reads a security advisory. This one is worth a phone call to the host rather than an email.
Source: PHP release announcement, 20 October 2026.
Also on the blog
- MikroTik RouterOS CVE-2026-88464: SNMP crash on 7.20 and later
- Plex Media Server CVE-2026-96656: exploited chain, CVSS 8.6
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.