What happened
- PHP’s security team announced on October 20, 2026 a critical security release for Wednesday, October 21 at 14:00 UTC (11:00 in Chile, summer time).
- The notice mentions two critical vulnerabilities, each scored 9.2 on CVSS v4.0. It does not list the CVE identifiers or affected versions, which will be published with the patch.
- PHP may move the release earlier if details become public or evidence of exploitation appears. It asks users to prepare to update as soon as it is out.
- According to BleepingComputer, the firm watchTowr says it reproduced one of the flaws (CVE-2026-109618) without publishing technical details and has seen no active exploitation. watchTowr describes both as remote code execution.
Why it matters
- PHP is the language of WordPress and of much of small-business shops and sites. A notice like this forces you to know which version each server runs before Wednesday.
- For anyone on shared hosting in Chile, the update usually depends on the provider. The useful question is not when the patch ships, but when whoever runs the server applies it.
- The consequence the notice does not state: announcing the existence of the flaw before the patch gives an edge to whoever tries to deduce it. That is why the 24-hour calendar matters.
The number
9.2. CVSS v4.0 score PHP assigns to each flaw. watchTowr speaks of 10.0, according to the outlet; the difference is not explained.
Context
The outlet reports the flaws were under embargo for a Thursday disclosure, and that PHP decided to publish earlier. A day’s advance notice from an open project is a debated practice: other recent cases, like the unpatched SGLang vulnerability, left users with no way out for days.
What’s next
- Wednesday, October 21, 2026, 14:00 UTC: release of the security version.
- Earlier, if exploitation appears or details leak.
- Pending: list of affected versions and official CVEs.
Bottom line
Not long ago Mamífero reported how an agent found vulnerabilities in Android. Flaws keep turning up in software that has run for decades.
Sources
- PHP.net — Upcoming Critical PHP Security Release (October 20, 2026)
- BleepingComputer — PHP warns admins of two critical flaws, emergency patches coming tomorrow (October 20, 2026, 4:56 PM; source for watchTowr’s position and the CVEs)
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
