# Special edition: Leaked PHP RCE bugs bring fixes forward to 03:00 NZDT Thursday > Two embargoed PHP flaws leaked early; patches due 14:00 UTC Wednesday, details still under wraps - Series: It's Probably Nothing - Special edition: CVE-2926-109618 - As of: 2026-10-20T21:04:12.881Z - [Subject history and latest update](https://ipn.nz/special-editions/d3b75aac-ef48-485f-8d2f-f27d2a1d6fff) - Publisher: Sierra Echo Charlie - Edition date (Pacific/Auckland): 2026-10-21 - Edition number: 7 - Status: Published edition - Language: en-NZ - [Canonical web edition](https://ipn.nz/special-editions/d3b75aac-ef48-485f-8d2f-f27d2a1d6fff/d2a47d36-391f-441b-8a41-f6da7bccbf8f) - [Download PDF](https://ipn.nz/pdf/IPN-special-d2a47d36-391f-441b-8a41-f6da7bccbf8f.pdf) - [MP3 audio](https://ipn.nz/audio/IPN-special-d2a47d36-391f-441b-8a41-f6da7bccbf8f.mp3) (4:11, 4016630 bytes) - [Standalone transcript](https://ipn.nz/transcripts/special-d2a47d36-391f-441b-8a41-f6da7bccbf8f.md) ## Opening Two PHP vulnerabilities that were meant to stay quiet until Thursday have had their existence leaked, and PHP has reportedly moved its fix forward a day. Nobody outside the embargo knows what's actually broken yet, which hasn't stopped anyone from arguing about how bad it is. ## 1. Leaked PHP RCE bugs push emergency fixes to 21 October 14:00 UTC First, housekeeping. If you've seen this called CVE-2926-109618, that looks like a typo that appears in watchTowr's own X post. The identifiers everyone else uses are CVE-2026-109618 and CVE-2026-109619. Nobody has started issuing CVEs for the year 2926 just yet. Now the substance. At about 15:20 UTC on Tuesday 20 October, according to Cyber Kendra, a Hacker News user posted a Tell HN claiming two CVSS 10.0 PHP remote code execution bugs affecting PHP 5 onwards were due out on 22 October. The post cited a reliable source and admitted it had no evidence. It has since been flagged. watchTowr then said the leak was genuine, that the bugs are real RCE zero-days, and that the embargo was meant to hold until Thursday 22 October at 11:00 ET. Cyber Kendra and Mezha, the latter relaying BleepingComputer, both report that the PHP security team then published an advance notice. It schedules a security release for Wednesday 21 October at 14:00 UTC, which works out to 03:00 NZDT and 01:00 AEDT on Thursday. As quoted, PHP said it will publish details plus affected and fixed versions with the release, and may ship earlier if details go public or exploitation turns up. I haven't read the notice directly, and the cached php.net page doesn't show it yet. The details are where it gets contested. PHP rates each flaw 9.2 under CVSS v4.0. Per Cyber Kendra, its notice doesn't name the CVEs or call them code execution bugs. That framing comes from watchTowr and the leak. watchTowr CEO Benjamin Harris told BleepingComputer that both are CVSS 10 and are understood to affect PHP 5, 6, 7 and 8. PHP 6 never shipped as a stable release, so I'd hold that version list loosely. Florian Roth says it's an RCE in PHP core and that only PHP 8 will get patches. watchTowr says it believes it has reproduced CVE-2026-109618, has seen no exploitation in the wild, and knows of no workaround before the patch. Per Cyber Kendra, the CVE records are still reserved. No affected function, extension or configuration has been named. My read is that this deserves real attention, with a side-eye at the CVSS 10 one-upmanship. A pre-patch leak of a bug in something as widely deployed as PHP core is unpleasant regardless of whether it scores 9.2 or 10. If Roth is right about PHP 8 only, the long-dead PHP 5 and 7 boxes still lurking on shared hosting and in forgotten corners become the real problem. They'd get no official fix at all. ### Worth asking The release lands in the small hours here, so do the boring prep today. Find every PHP version you run, including the ones in containers and on hosting you'd rather not think about. Current supported builds are 8.5.11, 8.4.26, 8.3.35 and 8.2.34 from 24 September, so anything older is already behind. Line up a change window for Thursday morning NZ/AU time. Then check whether your distro or hosting provider is shipping backports, because nothing from them was visible yet. ### Qualifications As of 21:04 UTC on 20 October, no patch, advisory text, affected-version list or technical detail was public, and no exploitation had been reported. PHP's notice, watchTowr's posts and the CVE records weren't read directly, so the details here rest on secondary reporting. Severity and version scope remain disputed until PHP publishes. ### Sources - [PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early - Cyber Kendra]() — reporting/context - [PHP schedules emergency fixes for two critical flaws on Oct. 21 after reported leak \| Межа]() — reporting/context - [Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming \| Hacker News]() — primary source - [PHP]() — primary source ## Audio transcript Narrated using an AI voice. Kia ora, this is a special edition of It's Probably Nothing. Two PHP vulnerabilities that were meant to stay quiet until Thursday have had their existence leaked, and PHP has reportedly moved its fix forward. As of about nine in the evening UTC on Tuesday the twentieth of October, nobody outside the embargo knows what's actually broken, which hasn't stopped anyone arguing about how bad it is. First, housekeeping. If you've seen this tagged with the year 2926, that looks like a typo in watchTowr's own post on X. Everyone else is using the 2026 identifiers, and nobody's issuing CVEs for the year 2926 just yet. Now the substance. Around 15:20 UTC on the twentieth, according to Cyber Kendra, a Hacker News user posted claiming two CVSS 10 PHP remote code execution bugs, affecting PHP 5 onwards, were due out on the twenty-second. The post cited a reliable source, admitted it had no evidence, and has since been flagged. watchTowr then said the leak was genuine, that these are real RCE zero-days, and that the embargo was meant to hold until Thursday the twenty-second at 11:00 Eastern. Cyber Kendra, and Mezha relaying BleepingComputer, both report that the PHP security team then put out an advance notice. It schedules a security release for Wednesday the twenty-first at 14:00 UTC. That's 3am Thursday New Zealand daylight time, and 1am Thursday in Sydney and Melbourne. As quoted, PHP says details and affected and fixed versions come with the release, and it may ship earlier if details go public or exploitation turns up. I haven't read that notice directly, and the cached php.net page doesn't show it yet. The details are where it gets contested. PHP rates each flaw 9.2 under CVSS version 4. Per Cyber Kendra, PHP's notice doesn't name the CVEs or call them code execution bugs. That framing comes from watchTowr and the leak. watchTowr's CEO Benjamin Harris told BleepingComputer both are CVSS 10 and are understood to affect PHP 5, 6, 7 and 8. PHP 6 never shipped as a stable release, so I'd hold that list loosely. Florian Roth says it's an RCE in PHP core and that only PHP 8 will get patches. watchTowr says it believes it's reproduced the first of the two bugs, has seen no exploitation in the wild, and knows of no workaround before the patch. Per Cyber Kendra, the CVE records are still reserved, and no affected function, extension or configuration has been named. My read: this deserves real attention, with a side-eye at the CVSS 10 one-upmanship. A pre-patch leak in something as widely deployed as PHP core is unpleasant whether it scores 9.2 or 10. And if Roth's right about PHP 8 only, the long-dead PHP 5 and 7 boxes lurking on shared hosting and in forgotten corners become the real problem, because they'd get no official fix at all. So, since the release lands in the small hours here, do the boring prep now. Find every PHP version you run, including in containers and on hosting you'd rather not think about. Current supported builds are 8.5.11, 8.4.26, 8.3.35 and 8.2.34, from the twenty-fourth of September, so anything older is already behind. Line up a change window for Thursday morning New Zealand and Australian time, and check whether your distro or hosting provider is shipping backports, because nothing from them was visible yet. To be clear about where this stands: no patch, advisory text, affected-version list or technical detail was public, and no exploitation had been reported. I haven't read PHP's notice, watchTowr's posts or the CVE records directly, so this rests on secondary reporting. Severity and version scope stay disputed until PHP publishes, and when it does, we'll know whether this was something, or probably nothing. Don't forget, all our threat intelligence comes from Mallory dot A I. If you want intelligence your team can act on, reach out for a chat. ## Publisher Researched by our AI agents using [Mallory](https://mallory.ai) and original sources. Reviewed and published by [Sierra Echo Charlie](https://sierraechocharlie.com). Want intelligence your team can act on? [Reach out for a chat.](mailto:letsgo@sierraechocharlie.com)