Two 9.2-Rated Flaws in PHP. The Patch Lands Today at 14:00 UTC — Attackers Got a Day’s Head Start.

Yesterday afternoon, an anonymous Hacker News post claimed — with no evidence at all, the poster admitted — that PHP had two CVSS-10 remote code execution flaws affecting everything from PHP 5 onward. Within hours, security firm watchTowr confirmed the flaws were real. By evening, PHP had pulled its release forward a full day. The patch ships today, October 21, at 14:00 UTC. This is the playbook for the hours before it lands — and the days after.

What PHP actually announced (and what it didn't)

The official notice on php.net, dated October 20, is nine sentences long. The PHP security team gave "advance notice of an upcoming security release" scheduled for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available."

Then the sentence that matters most: "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."

What the notice does not contain: CVE numbers, affected versions, or fixed version numbers. "Full details, affected versions, and the fixed versions will be published with the release." That is normal for an embargoed disclosure. What is not normal is the next part.

How the embargo broke before the release

At ~15:20 UTC on October 20, a now-deleted Hacker News post (user "petecooper") cited a "reliable source" claiming two CVSS-10 PHP RCE flaws affecting PHP 5 onward, with disclosure planned for October 22. The poster's own evidence: "source: trust me, bro."

Then the story changed. watchTowr confirmed on X: "We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real." Their post had a typo in the CVE IDs — "CVE-2926-109618/619" — which tells you how fast this moved. The corrected IDs: CVE-2026-109618 and CVE-2026-109619.

watchTowr CEO Benjamin Harris told BleepingComputer the flaws were leaked "in the last hour," had been embargoed for a Thursday 11 AM Eastern release, and were remote code execution flaws. The company believes it reproduced CVE-2026-109618 in its own lab — but is withholding technical findings until the patches ship. Crucially: watchTowr reported no exploitation in the wild at the time.

What we know about the flaws — and the evidence boundary

PHP has confirmed the severity and the schedule. It has confirmed nothing else. Everything below is third-party attribution, held at that distance:

• The CVE IDs are watchTowr-attributed, not official. PHP's notice names no CVEs. Both entries were still "reserved" on NVD with no description as of this morning.
• 9.2 vs 10.0. PHP rates the flaws CVSS v4.0 9.2. The leak and watchTowr say "CVSS 10.0" without naming which scoring version. Treat 9.2 as the number and the 10 as the rumor.
• "PHP 5 onward" is unconfirmed. That scope came from the anonymous HN post, repeated by watchTowr's CEO — but watchTowr's own FAQ says the affected range "has not been confirmed by an official vendor advisory." Researcher Florian Roth notes the flaw is in PHP core and that only the PHP 8 branches can receive patches.
• The mechanism is third-party speculation. External research describes an unauthenticated RCE path in PHP's multipart upload processing; other coverage points at session upload-progress handling, with one suggested interim mitigation: session.upload_progress.enabled=Off. But as DeXpose flags: "PHP has confirmed the severity and release schedule, not the full technical mechanism."
• An exploit tool is already being named. Sansec reported a screenshot of a tool called "PHP2Shell," credited to Calif.IO, circulating with the leak; its banner claims coverage from PHP 5.4.0 onward. Sansec predicts mass attacks could begin within roughly 15 minutes of the release. The "PHP2Shell" nickname is community shorthand, not PHP's.

On scale: only 8.2, 8.3, 8.4, and 8.5 can receive an upstream fix (8.1 went EOL December 2025; 8.2's own security support ends this December). Mallory counted roughly 884,000 internet-facing hosts whose banners reported PHP 8.1 or older to Shodan on October 20 — 59% of versioned hosts — plus ~740,000 more that reported PHP with no version. Those are banner reports, not confirmed vulnerable systems, but they show how much of the web runs PHP it can't patch.

What to do before 14:00 UTC, in the order that matters

The patch lands today at 14:00 UTC — 10 AM Eastern, 4 PM Central European, 8 PM in Dhaka. The window between now and then is for preparation, not panic:

1. Find every PHP on your network. Not just the app servers: cPanel/Plesk builds, containers, appliances, CI runners, dev stacks, the old WordPress site on the shared host you forgot about. php -v everywhere. Most teams discover at least one PHP they didn't know was running.

2. Know how your fix arrives. Distro packages (check whether your distro backports security fixes), panel builds (cPanel/Plesk ship their own PHP — their timeline is the one that matters), source builds (have your exact configure line ready), or managed hosting (ask your host now; several have already posted status pages saying they'll handle it).

3. Snapshot and back up first. PHP patch releases are usually safe, but extensions and pinned builds can break in odd ways. A snapshot is cheaper than a rollback at midnight.

4. Patch internet-facing systems first, in order of exposure. Public web servers, then internal apps, then everything else. Wordfence's threat team says it will assess firewall coverage as soon as the advisory drops.

5. If you're on 5.x, 7.x, or 8.1: no patch is coming for you. CERT-EU's guidance is blunt: isolate internet-facing apps on EOL PHP from public networks. If upgrading today is impossible, a WAF and network isolation are your only defenses.

6. Watch for the weaponization. Look for php-fpm, php-cgi, or Apache worker processes spawning shells, download tools, or interpreters. The precedent: when PHP shipped an out-of-cycle fix for CVE-2024-4577 (the Windows CGI RCE) in June 2024, Akamai's honeypots caught exploit attempts within 24 hours of disclosure. Sansec predicts ~15 minutes this time, because attackers already know the patch is coming today.

Why the next 48 hours matter

Is this fear-mongering? PHP says 9.2, watchTowr reports no exploitation in the wild, and the "CVSS 10 / PHP 5 onward" claims come from a leak whose poster admitted having no evidence.

No — because the leak inverted the normal disclosure timeline. Usually defenders get the patch and the details at the same moment attackers do. Here, attackers got a day's head start of awareness: everyone now knows a PHP core RCE patch drops at 14:00 UTC today, and tooling is already being named in screenshots. The June 2024 precedent says the gap between "patch available" and "exploit circulating" closes within a day. Preparation today costs almost nothing. A web shell tomorrow costs everything.

One honest caveat: this post publishes before the release, so the fixed versions, affected-versions matrix, and technical details all arrive at 14:00 UTC. Check the official advisory against everything above — the advisory wins, always.

The takeaway: 14:00 UTC today. Know where PHP runs in your stack, know how your fix arrives, snapshot, and patch the internet-facing systems first. The embargo already broke once — don't let your own patching be the second thing that runs late.

References

• PHP: Upcoming Critical PHP Security Release (php.net news archive, Oct 20, 2026)
• oss-security: Upcoming Critical PHP Security Release (mailing-list mirror, Oct 20, 2026)
• Wordfence: PSA — Upcoming Critical PHP Security Release (Oct 2026)
• DeXpose: PHP2Shell — How Security Teams Should Assess and Contain the Reported PHP RCEs
• Phoenix Security: PHP Core RCE CVE-2026-109618/109619
• PressWizards: Critical PHP Vulnerabilities — What Website Owners Need to Know and Do Now
• WindowsForum: PHP Critical Security Release Set for October 21