Upcoming PHP core RCE vulnerability patches (CVE-2026-109618 & CVE-2026-109619)
Добавлено: Ср окт 21, 2026 8:50 am
A heads up in case you weren't aware, a patch is being released tomorrow for two RCEs found in PHP core by Calif[1]. It affects PHP version 5 onwards[2].
The RCE appears to work on default installations of many commonly deployed services and frameworks such as WordPress, Magento, Laravel and more[3].
If you have deployed any service that runs on PHP, prepare to patch ASAP. As soon as the patch drops, attackers will begin to weaponise the vulnerability at scale.
Patch is reportedly being released at 14:00 UTC, however as per PHP's announcement (We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.), it may well drop sooner since details are beginning to leak.
[1] https://www.php.net/index.php#2026-10-20-1
[2] https://watchtowr.com/intelligence/php- ... 09618-faq/
[3] https://x.com/k_firsov/status/2112641845926989944
EDIT 03:00 UTC - A PoC for the vulnerability has dropped within the past hour: https://jackalsyn.com/posts/php-up-2026.html. This post mentions potential mitigations, but to be safe you should take any internet-facing PHP apps offline ASAP until you can patch properly, less you risk getting pwned. 🫡
https://www.reddit.com/r/sysadmin/comme ... y_patches/
The RCE appears to work on default installations of many commonly deployed services and frameworks such as WordPress, Magento, Laravel and more[3].
If you have deployed any service that runs on PHP, prepare to patch ASAP. As soon as the patch drops, attackers will begin to weaponise the vulnerability at scale.
Patch is reportedly being released at 14:00 UTC, however as per PHP's announcement (We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.), it may well drop sooner since details are beginning to leak.
[1] https://www.php.net/index.php#2026-10-20-1
[2] https://watchtowr.com/intelligence/php- ... 09618-faq/
[3] https://x.com/k_firsov/status/2112641845926989944
EDIT 03:00 UTC - A PoC for the vulnerability has dropped within the past hour: https://jackalsyn.com/posts/php-up-2026.html. This post mentions potential mitigations, but to be safe you should take any internet-facing PHP apps offline ASAP until you can patch properly, less you risk getting pwned. 🫡
https://www.reddit.com/r/sysadmin/comme ... y_patches/