PHP security releases fix two remote code execution bugs after early leak
Releases across PHP 8.x fix two RCE flaws reported by Wiz Research. Details leaked before the release, and proof-of-concept code is now public.
The PHP project shipped security releases across the PHP 8.x line on 21 October 2026. They fix two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Developer Simon Willison advised anyone running PHP to upgrade.
Early leak
The PHP Foundation says the two CVE IDs started circulating online on 20 October, around 15:00 UTC. They came with a wrong release time and a wrong CVSS score of 10.0; the real score is 9.2. The project moved the release forward a day, to 21 October at 14:00 UTC. One of the reporting security firms then mistakenly published a video of its proof of concept, which sped up public exploit development. Proof-of-concept code is now on GitHub.
Background
According to the timeline Willison quotes, Wiz Research found the first bug on 19 August 2026 and confirmed unauthenticated RCE against Drupal and WordPress. It reported the bugs to PHP on 24 August.
Fixed versions
Fixed releases for each PHP 8.x branch were published on 21 October, including 8.2.35 on the 8.2 line.