PHP Plans Fixes for Two Critical Flaws That Could Allow Remote Code Execution

PHP plans to release fixes for two critical security flaws at 10 a.m. ET (14:00 UTC) on Oct. 21, raising potential exposure concerns for PHP-based crypto websites and services.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a 9.2 rating under CVSS v4.0. They could allow remote code execution on affected servers, meaning an attacker could run commands over a network. PHP has not yet confirmed which versions are affected.

PHP issued a security notice on Oct. 20. Operators can prepare to update when fixes become available. It may release the updates earlier if details of either flaw become public or evidence of active exploitation appears.

PHP is used in website and server back ends, making the warning relevant to PHP-based exchange websites, crypto project sites and payment gateways.

Operators can identify installations and prioritize services exposed to the public internet. Isolating those services is an option when an immediate update is not possible.