On October 20, PHP announced that it will publish a security release at 14:00 UTC on October 21 and urged all users to prepare to upgrade as soon as it is available.
SlowMist (@SlowMist_Team) reports that the two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0, and may allow remote code execution. PHP has not yet named the affected versions. Third-party reports suggest releases from PHP 5 onward may be affected, and no exploitation in the wild has been confirmed so far.
Where small teams are exposed
Process
Websites, admin back offices, blogs and ticketing systems are often built by contractors or early staff with no asset inventory, so when a patch lands nobody can say which servers run PHP or who owns them.
Risk
The systems most easily missed sit at the edges: old campaign pages, test environments and third-party-hosted WordPress sites. They face the internet directly and tend to be patched last.
Privileges
Once a web server is compromised, an attacker can read its config files, database connections, cloud keys and deployment credentials. How far the damage spreads depends on how much access that machine was given.
Five things you can do now
- Today, list every server, container and hosted site that runs PHP, with its version, owner and whether it faces the internet
- Assign someone to track the official release, then upgrade internet-facing systems first and record when each one is done
- For internet-facing services you cannot upgrade right away, narrow access first, for example with WAF rules, source-IP limits on admin entry points, or by taking unneeded pages offline
- Review the keys and database accounts stored on web servers, keep only the minimum each service needs, and never keep fund-related private keys or signing credentials on these machines
- Ask your hosting providers and contractors for their upgrade plans and timelines, and track them on a follow-up list
Written before the official patch was released. Vulnerability details, affected versions and fixed versions follow PHP's official announcement; the claim that releases from PHP 5 onward are affected comes from third parties and has not been confirmed by PHP.
