Two critical remote code execution vulnerabilities have been found in PHP itself. Treat all versions as affected.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both have a CVSS v4.0 score of 9.2. The PHP security team will release fixes on October 21, 2026, at 16:00 CEST / 10:00 EDT / 07:00 PT.
If you run PHP anywhere in your stack, please stay tuned for workarounds and patches. Be prepared to take action.
We are working with the PHP Foundation and security comunity to coordinate the release of patches and further information. We are working to release Aikido Images that patch the vulnerabilities without requiring extensive updates.
What happened
The PHP security team published an advance notice on October 20 after information about the vulnerabilities leaked ahead of the planned disclosure date. Independent researchers confirmed the flaws were real, and the PHP team moved the release up to October 21. The vulnerabilities are continuing to circulate.
Open sources have identified the exploitable behaviour outside of the embargo and threat actors are more likely to attempt exploitation before patches become available.
How the vulnerabilities work
We’re holding back exploitation details while systems are still being patched. More information will be made publicly available tomorrow with the patches, or earlier should details of either vulnerability become public, or should evidence of active exploitation appear. See the php site for more information.
