The PHP security team has given website operators an unusual advance warning: prepare for an emergency release on October 21 at 14:00 UTC. Two critical PHP vulnerabilities are behind it, each rated 9.2 under the CVSS v4.0 severity system.
In its October 20 notice, the team encouraged users to prepare to upgrade immediately when the release becomes available. It may publish earlier if technical details leak or evidence of active exploitation emerges. The announcement did not yet identify affected versions or the releases containing fixes.
What the critical PHP vulnerabilities could expose
PHP runs on servers, generating web pages and handling application logic before a visitor receives the result. That places this alert beneath the visible website: the software requiring attention may be managed by a hosting provider or bundled inside another product.
CERT-EU identifies the vulnerabilities as CVE-2026-109618 and CVE-2026-109619 and warns of potential remote code execution without authentication. In plain language, that could let an attacker run code on an affected server without first signing in. Exact exposure still depends on technical conditions that PHP’s advance notice had not disclosed.
Reports suggesting a very broad range of PHP versions may be affected are not a substitute for the vendor’s final list. A critical severity score also does not establish that every installation has been attacked or compromised.
When taking a site offline enters the picture
The UK National Cyber Security Centre’s October 21 alert asks organisations to identify systems running any PHP version, prioritise those exposed to the internet, monitor for malicious activity and prepare to apply updates. It also calls for following third-party vendors whose appliances or services may include PHP.
The more disruptive advice is conditional: where immediate remediation is not feasible, NCSC says organisations should consider taking the system offline until the risk can be fully mitigated. CERT-EU similarly recommends considering isolation of internet-facing applications. Neither is a blanket instruction to disconnect every PHP website.
For a site owner, the useful question is who controls the server runtime and how the provider will deliver the security release. Editing pages or installing an unrelated application update does not establish that PHP itself has been patched.
The coming release should supply the missing affected-version and fixed-version details. Until then, the immediate task is to make sure somebody owns the update—and the contingency decision if it cannot be applied promptly.
