An emergency release triggered by a leak and a maximum CVSS score

PHP announced a security update outside its usual cycle for October 21, 2026, at 14:00 UTC, following a leak revealing the existence of two critical vulnerabilities. According to The Hacker News, these flaws, identified under references CVE-2026-109618 and CVE-2026-109619, would allow remote code execution (RCE). Their CVSS score was mentioned as 10.0 on some platforms like Hacker News, although official sources such as watchTowr and BleepingComputer cite a score of 9.2 under CVSS v4.0 for now.

The PHP team clarified in an advisory published on October 21 at 19:33 UTC that it reserves the right to advance the release of patches if technical details leak or if active exploitation is detected. This preventive measure comes in a context where watchTowr has confirmed the existence of the vulnerabilities, while maintaining an embargo on technical details to avoid premature exploitation.

The PHP team reserves the right to publish patches earlier if details leak or if active exploitation is detected, an unprecedented reaction for a still-undisclosed vulnerability.

Only supported PHP versions 8.2 to 8.5 will be patched, others abandoned

The emergency patches will only apply to PHP branches 8.2 to 8.5, as other versions are considered obsolete by the PHP team. According to The Hacker News, this restriction applies because earlier versions (such as PHP 5, 6, or 7) no longer receive active support. watchTowr, however, mentioned research suggesting that vulnerabilities could affect versions 5 to 8, though this information has not been officially confirmed.

This limitation raises a risk for organizations using unsupported versions, which will receive no patches. The CERT-EU has already recommended isolating exposed applications on the Internet until updates are available, a cautious measure while awaiting clarifications on the exact scope of the flaws.

No active exploitation detected, but a leak accelerates preparations

Despite the leak of information, neither watchTowr nor Huntress have reported active exploitation of the vulnerabilities in the wild. Benjamin Harris, CEO of watchTowr, confirmed on X that the details were disclosed before the scheduled date (originally set for October 22), but without evidence of malicious use. However, the PHP team responded by releasing an official statement earlier than expected, emphasizing the severity of the situation.

A deleted post on Hacker News had mentioned a CVSS score of 10.0 for these vulnerabilities, the highest possible rating indicating a critical risk. While this information must be confirmed by PHP, it reflects the urgency perceived by the cybersecurity community. Shodan and Mallory, vulnerability monitoring platforms, could be mobilized to identify exposed systems before patches are released.

What this changes here: risks for West African administrations and businesses using PHP

For Beninese or West African businesses and administrations using PHP in their critical infrastructures (websites, back-ends, APIs), this announcement requires immediate action. Unsupported versions (PHP 5 to 7) could become prime targets if attackers focus on outdated systems lacking patches. Even for versions 8.2 to 8.5, the deadline before October 21 leaves a window of exposure, especially since technical details are lacking to apply specific countermeasures.

Organizations relying on PHP for public services or e-government platforms should prioritize updating their systems as soon as patches are available, or consider temporarily isolating exposed servers, as suggested by the CERT-EU. SMEs using shared hosting or CMS platforms like WordPress (which depends on PHP) must also verify compatibility with updates to avoid disrupting their services.

Finally, this crisis underscores the importance of diversifying technologies to mitigate risks. In West Africa, where cybersecurity resources are sometimes limited, an over-reliance on a single technology like PHP exposes administrations to systemic risks. Local consulting firms could be engaged to audit infrastructures and propose tailored mitigation strategies.