{"id":935615,"date":"2026-10-21T02:04:09","date_gmt":"2026-10-21T02:04:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/935615\/"},"modified":"2026-10-21T02:04:09","modified_gmt":"2026-10-21T02:04:09","slug":"alert-php-preparing-to-address-pair-of-critical-rce-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/935615\/","title":{"rendered":"Alert! PHP preparing to address pair of Critical RCE vulnerabilities"},"content":{"rendered":"<p>The PHP security team warned users of an upcoming Critical PHP Security Release in a brief post on October 20 regarding \u201ctwo critical vulnerabilities, both rated CVSS v4.0 9.2\u201d.<\/p>\n<p>\u201cAll PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,\u201d <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1\" target=\"_blank\" rel=\"noopener nofollow\">PHP said<\/a>.<\/p>\n<p>\n        You\u2019re out of free articles for this month    <\/p>\n<p>&#13;<\/p>\n<p>\u201cWe reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.\u201d<\/p>\n<p>&#13;<\/p>\n<p>The advisory added that full details, which versions are impacted, and which versions were fixed would be published alongside the release; however, it appears details have already leaked \u2013 and the vulnerabilities look serious.<\/p>\n<p>&#13;<\/p>\n<p>PVP had already said both vulnerabilities featured CVSS scores of 9.2, which is bad enough. They are both, however, also remote code execution vulnerabilities and, according to cyber security firm watchTowr, very real and very worrying.<\/p>\n<p>&#13;<\/p>\n<p>\u201cInformation has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they&#8217;re real. CVE-2926-109618\/619,\u201d the company said in an overnight <a href=\"https:\/\/x.com\/watchtowrcyber\/status\/2112611507749982605\" target=\"_blank\" rel=\"noopener nofollow\">post to X<\/a>.<\/p>\n<p>&#13;<\/p>\n<p>\u201cWe cannot share further information right now. Take this seriously and apply patches when available.\u201d<\/p>\n<p>&#13;<\/p>\n<p>Benjamin Harris, the company\u2019s CEO, shared information on the developments with Cyber Daily.<\/p>\n<p>&#13;<\/p>\n<p>&#8220;In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET,\u201d Harris said overnight.<\/p>\n<p>\u201cWhile we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real.\u201d<\/p>\n<p>&#13;<\/p>\n<p>However, while PHP had originally said the vulnerabilities were less than a perfect 10, watchTowr has said that is exactly what they are, and that they impact PHP versions 5, 6, 7, and 8. <\/p>\n<p>\u201cPatches are currently unavailable, but we anticipate that the patch release will now be significantly faster and swifter than the Thursday at 11 am that was previously scheduled,\u201d Harris added.<\/p>\n<p>&#13;<\/p>\n<p>watchTowr said it has already successfully reproduced CVE-2026-109618; the company added it \u201cwill wait for the patches from PHP before sharing any further information\u201d. <\/p>\n<p>&#13;<\/p>\n<p>PHP is an open-source scripting language designed primarily for web development.<\/p>\n","protected":false},"excerpt":{"rendered":"The PHP security team warned users of an upcoming Critical PHP Security Release in a brief post on&hellip;\n","protected":false},"author":2,"featured_media":935616,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[64,63,105],"class_list":["post-935615","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-au","tag-australia","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/935615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=935615"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/935615\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/935616"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=935615"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=935615"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=935615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}