Security firm Aikido Security said on October 21 that two critical flaws have been found in PHP, the language behind much of the web. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a server from afar. Each scores 9.2 on the CVSS v4.0 scale, which rates severity out of 10. Aikido says all PHP versions should be treated as affected. It says the PHP security team will release fixes on October 21 at 16:00 CEST.
Aikido said the PHP team gave advance notice on October 20, after details leaked before the planned date. Independent researchers confirmed the flaws were real, and the team moved the release up a day. Aikido said the behaviour behind the bugs has been spotted in open sources, so attackers may try to use them before patches arrive. Exploit details are being withheld for now. Aikido said it would share more if details become public or active attacks appear. The sources do not say which PHP versions are fixed, what the workarounds are, or whether anyone has been attacked. Aikido said it is working on patched images.
Anyone who runs PHP, directly or inside a web stack, may need to patch quickly once the fixes ship. Aikido's advice is to be ready to act. Teams can start by listing where PHP runs in their systems.