Critical PHP Security Alert: Two 9.2-Severity Vulnerabilities
On 20 October 2026, the PHP security team announced two critical vulnerabilities, each rated 9.2 under CVSS v4.0. A coordinated security release was scheduled for 21 October 2026 at 14:00 UTC. At the time of this article, the official pre-announcement did not specify fixed releases or confirmed affected branches.
What has been confirmed
On 20 October 2026, the PHP security team announced two critical vulnerabilities, each rated 9.2 under CVSS v4.0. A coordinated security release was scheduled for 21 October 2026 at 14:00 UTC. At the time of this article, the official pre-announcement did not specify fixed releases or confirmed affected branches.
Identifiers and potential impact
CERT-EU lists CVE-2026-109618 and CVE-2026-109619 and warns that the issues could permit unauthenticated remote code execution. The exact exploit conditions and affected versions had not yet been officially detailed. Reports of possible exposure across older PHP versions should not be mistaken for a confirmed complete affected-version matrix.
What administrators should do now
Inventory every PHP runtime and application, including CLI and PHP-FPM versions. Monitor the official PHP release notes and your distribution security tracker. Install vendor-provided fixed packages as soon as available, restart the relevant PHP-FPM services, and verify the running version and package changelog. Back up application data and test critical workflows before rollout where feasible.
For Debian, Apache and Nginx
Check installed packages with dpkg -l and apt policy, and inspect each FPM pool. Keep the Debian security repository enabled. Do not assume that a patched distribution package must display the newest upstream version: Debian may backport security fixes. Verify the distribution advisory and package revision. Web application firewalls are useful defense in depth, not a replacement for a PHP fix.
Exposure and incident response
Restrict unnecessary public endpoints and consider temporarily isolating affected applications if prompt remediation is impossible. Review web, reverse-proxy, PHP-FPM and security logs for anomalies; preserve evidence before making destructive changes. If compromise is suspected, rotate relevant credentials after containment and investigate persistence and data access.
Status and updates
This is a point-in-time advisory written before the announced release time, not confirmation that exploitation has occurred. Check PHP.net and CERT-EU for the latest affected-version details and patched releases before treating any system as safe.