PHP warns of two critical security vulnerabilities
The vulnerabilities could lead to remote code execution, according to European cybersecurity experts.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
PHP developers have warned administrators about two critical vulnerabilities in the programming language. A security update is scheduled for Wednesday 21 October at 14:00 UTC, but technical details have not yet been made public.
PHP announced the warning on Tuesday in its official news archive. According to the PHP team, each of the two vulnerabilities has a score of 9.2 on the CVSS v4.0 scale, which indicates the severity of digital security problems. The team says full details and the affected versions will be published at the same time as the security updates.
CERT-EU, the cybersecurity body of the European institutions, confirms that these are two critical vulnerabilities. According to the service, they could potentially lead to remote code execution: the running of commands on a computer without the attacker being physically present. CERT-EU says that no technical details are yet available.
The PHP administrators are calling on organisations to prepare in advance for installing the patches. CERT-EU advises administrators who cannot update immediately to temporarily shield internet-facing applications from public networks. This is a general precautionary measure; the service does not report that any attacks have already been identified.
Security company watchTowr told BleepingComputer that the vulnerabilities are known as CVE-2026-109618 and CVE-2026-109619. The company suspects that the problems affect multiple generations of PHP, but PHP itself had not confirmed this before the scheduled release. The precise technical cause and the way in which exploitation might be possible have also not yet been made public.
For organisations using PHP for websites, online shops, content management systems or bespoke applications, a vulnerability could have consequences, but the scale can only be determined once the affected versions and solutions have been published. BleepingComputer writes that researchers have not yet observed exploitation in the wild. Administrators would therefore be wise to await the official release, take stock of their systems, and test and apply patches promptly.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article's core is based on PHP's official announcement and confirmation from CERT-EU. Unconfirmed technical details are clearly marked as researchers' suspicions.
- confirmed PHP announced two critical vulnerabilities, each with a CVSS v4.0 score of 9.2. — Mentioned in PHP's official news archive. source
- confirmed The security update is scheduled for 21 October 2026 at 14:00 UTC. — Mentioned by PHP and CERT-EU. source
- confirmed The vulnerabilities could potentially cause remote code execution. — CERT-EU describes this as a possible consequence; technical details are not yet public. source
- confirmed No exploitation in the wild has been observed. — BleepingComputer writes this based on information from watchTowr. source
Editor's note
The warning and planned release date have been officially confirmed. At the time of publication, the technical details, affected versions and any active exploitation were not yet known.Sources
More on this in Dutch media
- de Volkskrant — „php cybersecurity”
- NOS — „php cybersecurity”
- Het Parool — „php cybersecurity”