PHP: critical remote-code-execution flaw (CVSS 4.0 9.2) fixed in a security release pre-announced for 2026-10-21 14:00 UTC; the id is named by CERT-EU and Sansec and had no CVE.org record when read

CVE-2026-109618 / CVE-2026-109619, PHP: two critical flaws rated CVSS 4.0 9.2, which CERT-EU reads as possible remote code execution, are to be fixed in a release pre-announced for 21 October 14:00 UTC, with a screenshot of an exploit tool reported leaked

The PHP security team announced on 2026-10-20 a security release for Wednesday 2026-10-21 at 14:00 UTC that addresses two critical vulnerabilities, both rated CVSS 4.0 9.2, with the affected and fixed versions and the technical details to be published with the release; it reserves the right to release earlier if details become public or exploitation appears (PHP, 2026-10-20). CERT-EU names the two as CVE-2026-109618 and CVE-2026-109619, reads their scores as indicating potential unauthenticated remote code execution and, citing a social-media post, says they could affect all PHP versions from PHP 5 onwards (CERT-EU, 2026-10-21). Sansec reports that information on the embargoed bugs leaked on 20 October, that watchTowr confirmed them as remote code execution flaws in PHP, and that a screenshot of an exploit tool named PHP2Shell, credited to Calif.IO, leaked with a banner claiming it works against every PHP release from 5.4.0; it expects mass attacks within 15 minutes of the release (Sansec, 2026-10-21). Those are Sansec's claims; the PHP project has published no technical detail and no fix is listed on php.net as of 2026-10-21.

PHP supports branches 8.2 and later, so Sansec says servers on PHP 8.1 or older will not get an official fix (Sansec, 2026-10-21). The fix is applied to the PHP runtime on the server, not to a CMS, plugin or theme, so updating WordPress or its plugins does not change exposure, and PHP installed from operating-system packages, a control panel or container images may arrive on a different schedule from php.net (Wordfence, 2026-10-20).