Uncertainty creates ample room for speculation and malicious activity. Essential dos and don’ts until the official patch drops.
Two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are set to be patched today. The PHP security team rates both CVSS v4.0 9.2, and researchers describe them as unauthenticated remote code execution. Beyond that, there’s very little anyone can say for sure yet.
Until 14:00 UTC, it’s all speculation
PHP has scheduled the emergency release for Wednesday, October 21, 2026, at 14:00 UTC (10:00 ET), and reserves the right to ship earlier if details go public or exploitation shows up in the wild (BleepingComputer).
The official advisory names no vulnerable function, no affected versions and no fixed releases. The CVE IDs, the “PHP 5 through 8” scope and the CVSS 10 figures all come from researchers and a leak, not from PHP.
Anything else outside of the official PHP release still theory.
One thing worth doing now: turn off uploads you don’t use
We don’t know whether file uploads are involved here. But if your PHP apps never accept uploads, there’s no reason to leave the handling enabled. Set this in php.ini, then reload PHP-FPM or your web server:
file_uploads = Off
It’s cheap, it shrinks your attack surface, and it’s good hygiene regardless of the CVEs dropping today.
Don’t go hunting for PoCs
A screenshot of an exploit tool called “PHP2Shell” has already leaked alongside the advisory (Sansec). Expect “exploits” and “scanners” for these CVEs to pop up on GitHub and Telegram before PHP publishes anything.
Skip them. Pre-disclosure PoCs for hyped bugs are a classic way to ship malware to security teams. These could easily be a waste of your time and give false confidence. Best practice is to wait for the official fix.
What’s next
Once PHP ships the patch, the OX research team will break it down from the official diff: what changed, which versions are affected, and how to tell if you’re exposed. Until then, line up your PHP runtime owners so you can patch the moment it lands.