Raw exploits for the flaws have begun circulating after technical details were leaked prior to planned disclosure. Experts are urging administrators of internet-facing applications to take their servers offline or prepare for an immediate patch rollout to prevent compromises. A monitoring tool called process-watcher has also been released to help technicians detect suspicious sub-process spawns before the official updates are available.
Tuesday, October 20, 2026
Story
PHP Patches Two Critical RCEs in Versions 5 to 8 on Oct 21
Cybersecurity2 hours ago
A critical security update will address software flaws that leave systems open to remote takeover. The PHP security team will release updates at 14:00 UTC on October 21 to resolve two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. These remote code execution flaws reportedly affect versions 5 through 8 of the language, according to researchers at watchTowr, though the team may accelerate the release if exploitation is detected.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.