Why PHP's Two Critical Flaws Leaked Early and Forced a 21 October Security Release

PHP is widely used on the web. W3Techs puts its use at 69.3% of all websites whose server-side language it can identify, a figure dated 21 October 2026. On that day, the PHP project published security fixes for two critical remote code execution flaws in the language itself, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The flaws were meant to be disclosed in a coordinated way, but details leaked on 20 October. PHP's own notice set the release for Wednesday, 21 October at 14:00 UTC, a day before the Thursday date that appeared in the leaked post. PHP published the full details and the fixed versions with the release.

What PHP Is and How Much of the Web Runs on It

PHP is a scripting language for creating websites. W3Techs classes it as a server-side programming language.

W3Techs, which tracks web technology usage, reports that PHP is used by 69.3% of all websites whose server-side programming language it knows.

Each PHP release line has its own end date. The PHP project's supported-versions page lists security support for 8.2 until 31 December 2026, 8.3 until 31 December 2027, 8.4 until 31 December 2028 and 8.5 until 31 December 2029.

A site running a branch past its end date receives no further security fixes from the PHP project.

What the Two Flaws Allow, and What PHP's Advisory Says

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, which PHP's advance notice did not name and its 21 October advisory does. PHP's notice rates both at 9.2 on CVSS v4.0 and calls both critical.

Researchers at watchTowr say the flaws allow remote code execution. PHP's advisory describes them as remote code execution through out-of-memory corruption (CVE-2026-109618) and through stale global state (CVE-2026-109619), and says they can be triggered without logging in. It rates the risk highest on Apache with mod_php, where a demonstrated exploit runs before any application code.

PHP's advisory puts every PHP installation serving web requests at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The leaked post claimed that every PHP version from PHP 5 onward was affected. The advisory does not list affected version ranges.

The 10.0 severity score in the leaked post came from the leak, not from PHP.

How the Planned Disclosure Leaked on 20 October

On 20 October, a post described two PHP remote code execution flaws, gave them a CVSS 10.0 score and said they would be disclosed on Thursday, 22 October. According to The Hacker News, the post offered no evidence beyond its own claim.

The post included the existence of the flaws, the score, a date and the two CVE numbers, but nothing on how the flaws work. watchTowr later posted on X that the leak was real and that the flaws were under embargo, with everyone expected to wait until Thursday. Its chief executive, Benjamin Harris, told SecurityWeek that the company could confirm the vulnerabilities were real.

PHP's notice, posted at 19:33 UTC on 20 October, set the release for 14:00 UTC on Wednesday, 21 October, a day ahead of the leaked date. The notice says PHP may release sooner if details become public or if there is evidence of active exploitation.

The embargo that watchTowr described pointed to Thursday as the planned date, and PHP's release moved the fix to the day before. PHP published the full details with that release.

What the 21 October Release Covers, and Which Versions Get Fixes

PHP's fixes arrived on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The releases cover PHP's supported branches, 8.2 through 8.5. PHP 8.1 and older get no new releases. Given the severity, PHP's security team published minimal source backports for 7.4, 8.0 and 8.1, for people who build PHP from source or have no long-term-support vendor, and PHP says some Linux distributions and support vendors provide backported fixes.

PHP's advisory confirms the fixed versions as 8.5.12, 8.4.27, 8.3.36 and 8.2.35, the numbers Alpine Linux and the security researcher Kevin Beaumont had expected, according to The Hacker News. PHP says there are no complete mitigations and that updating is the only safe choice.

The 8.2 branch is the nearest to its end date. Its security support runs to 31 December 2026, about two months after this release, according to the supported-versions page.

PHP records each branch's changes in its changelog, according to The Hacker News.

No Exploitation Reported So Far, and Sites on Older Branches Have the Least Cover

No source reports that the flaws are being used in attacks. Huntress said that as of 20 October it had not seen exploitation in its partner environments, had not built a proof of concept and was not aware of public exploit code, according to The Hacker News.

watchTowr reports no exploitation as of 21 October, and says the flaws are not in CISA's Known Exploited Vulnerabilities catalogue, per The Hacker News. SecurityWeek reports that watchTowr and Huntress have not seen either flaw exploited in the wild.

Sansec, as SecurityWeek reports, says mass exploitation will likely start within 15 minutes of the patch release. That is a forecast from Sansec, not a reported observation.

This figure counts what servers report. Mallory counted about 884,000 internet-facing hosts reporting PHP 8.1 or older on Shodan on 20 October, which The Hacker News describes as 59% of roughly 1.5 million hosts that report a PHP version. Those are version banners, not confirmed vulnerable systems.

For sites on 8.1 and older, the release brings no new PHP version. Their options are PHP's source backports, a backport from their distribution or support vendor, or an upgrade to a supported branch.