The PHP security team has scheduled a security release for 21 October 2026 at 14:00 UTC. It is intended to address two critical vulnerabilities, each rated CVSS v4.0 9.2 out of 10. CERT-EU's Security Advisory 2026-018 identifies CVE-2026-109618 and CVE-2026-109619 and warns about possible remote code execution.

PHP had not yet published the technical details, affected versions, or fixed versions when this status was recorded. The warning is confirmed, but the exposure of individual deployments remains unknown. Remote code execution could let an attacker make a server run code remotely. Depending on the flaw and the affected process's permissions, possible consequences include access to application data, exposed credentials, or changes to website files. These are potential effects of the vulnerability class, not confirmed results for every PHP installation.

CERT-EU recommends identifying PHP applications and preparing to install the fixes as soon as they are available. If immediate remediation is impossible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied. The advisory does not require every organisation to shut down every server.

Teams should first establish who can update PHP in production. Application developers, server teams, and hosting providers may control different parts of an environment, and client sites may use separate arrangements. An inventory should cover public websites, APIs, administrative tools, and older projects. Record each environment, its deployed PHP version, and the person responsible for updates. Check the runtime serving web requests, because a command-line version check may show a different installation.

Before deployment, confirm that backups exist and that a recovery plan is available. Identify the update method for each environment and prepare checks for essential application functions. Once PHP publishes the advisory, compare deployments with the affected versions and configurations. Use the fixed versions specified by PHP, the operating-system vendor, or the hosting provider. Do not infer a safe version from social media reports.

After updating, verify that the application uses the patched runtime. Test authentication and important API requests, then check uploads, database operations, and background processing where applicable. Record which environments are fixed and which still require action.

This status was prepared on 21 October 2026 from notices available before the scheduled release. The relevant sources are PHP's notice on the upcoming critical security release and CERT-EU Security Advisory 2026-018.