Two Critical Holes in PHP, the Language Most of the Web Runs On, Get Patched at 10 A.M. Eastern.

PHP's security team has given the web a deadline and a rating. Two critical vulnerabilities in the language are patched on Wednesday, 21 October 2026 at 14:00 UTC, and both are rated 9.2 under CVSS v4.0 1. The notice asks every PHP user to prepare to update the moment the release lands, and reserves the right to ship earlier if the details leak or attacks start.

The details leaked anyway. By Tuesday evening the two identifiers were circulating — CVE-2026-109618 and CVE-2026-109619 — along with a screenshot of an exploit tool, and the release had already been pulled forward from its original Thursday slot. What follows is what is public on the morning of the patch.

These are remote code execution bugs. watchTowr, the security firm that tracks this sort of disclosure, told BleepingComputer it can confirm both are real and says it has reproduced CVE-2026-109618 in its lab 2. CERT-EU reads the 9.2 score as indicating the potential for unauthenticated remote code execution: an attacker who has not logged in to anything can run their own code on the server 3.

No advisory yet names a root cause, an affected component, or an attack path. PHP says full details and affected versions ship with the fix 1. Leak reports and watchTowr's FAQ put the range at every PHP version from PHP 5 onward, which starts in 2004 4.

14:00 UTC is 10:00 a.m. Eastern. The e-commerce forensics firm Sansec expects mass attacks to start within fifteen minutes of the release, and its advice is blunt about where the work happens: PHP has to be updated on the server, not inside the site's own code 5. Anyone who does not run their own servers should ask their hosting provider to stand by today.

CERT-EU goes one step further for organisations that cannot move that fast: consider isolating internet-facing applications from public networks until a fix can be applied 3. Cloudflare's Dane Knecht said the company had already deployed WAF rules for the known exploit vectors, available on every plan including the free one, and called that a stopgap only 6.

The plan had been to publish on Thursday 22 October at 11:00 a.m. Eastern. watchTowr's public statement was that the information leaked ahead of that embargo 2. A Hacker News post by a user called "petecooper", since deleted, named both CVE identifiers and claimed a CVSS of 10.0 — higher than the 9.2 PHP itself assigned.

The leaked screenshot shows a tool called PHP2Shell, credited to Calif.IO, whose banner claims it works against every PHP release from 5.4.0 onward 5. Alongside it, a video showed the tool executing code against nine PHP applications: WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS 7.

PHP only supports version 8.2 and later, which means servers on PHP 8.1 or older will not receive an official fix at all 5. That is a large group. Among the sites that use PHP, W3Techs counts 65.2% on PHP 8, 27.0% still on PHP 7 and 7.7% on PHP 5 8. For that third of PHP sites, the task is a backport or a migration of a live application, not a package update.

PHP is used by 69.3% of all the websites whose server-side programming language is known 8. A rough estimate from the security researcher Silas Cutler, cited by Ars Technica, puts the number of internet-exposed hosts vulnerable to PHP2Shell at over 1.3 million 7.

As of Wednesday morning, watchTowr and Huntress had not seen either vulnerability exploited in the wild, and neither CVE appears in CISA's Known Exploited Vulnerabilities catalogue 4. The window Sansec describes opens when the tarball lands at 10:00 a.m. Eastern.

"TEN AM EASTERN" is an original Detroit trap song and music video built from those sources — one song, one day's news, with the running time and the rating as the hook.