Researchers Warn of Upcoming Critical PHP Flaws

Word of two critical unpatched vulnerabilities in several versions of PHP has begun to leak, ahead of what was meant to be a coordinated disclosure of the flaws on Thursday morning. The release is now scheduled for Wednesday at 9 AM EDT.

Security researchers warned about the bugs on Tuesday afternoon after a post with some meager information about the bugs appeared on Hacker News. The two flaws are CVE-2026-109618 and CVE-2026-109619 and are said to affect PHP versions 5, 6, 7, and 8. 

“In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET. While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS 10 and are understood to affect PHP versions 5, 6, 7, and 8,” Ben Harris, founder and CEO of watchTowr said in a statement.

“Patches are currently unavailable, but we anticipate that the patch release will now be significantly faster and swifter than the Thursday at 11 am that was previously scheduled.”

The PHP Group posted an early notice about the flaws on Tuesday afternoon, shortly after the initial information about the bugs began to seep out.

"All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the notice says.

PHP is an overwhelmingly popular scripting language that is found on somewhere north of 60 percent of websites by some estimates. Serious vulnerabilities in PHP are not uncommon, and because the language is so widely used, attackers often favor them when they surface.

Specifics of the two vulnerabilities are still under wraps, but researchers say both of them can lead to remote code execution.