The PHP security team has thrown up a big red flag, urging administrators to brace themselves for emergency updates tomorrow. Why, you ask? Because two shiny new vulnerabilities have decided to crash the party.
PHP, the backbone of countless websites and web applications (you know, the ones that run your favorite cat video blogs), is about to release fixes on October 21, at 14:00 UTC (or 10:00 AM Eastern, for those who prefer to live in the now). These vulnerabilities, rated a staggering 9.2 on the danger scale (because everything's a contest, right?), have apparently leaked out before the big reveal.
According to an advisory released on Tuesday (because Tuesdays are apparently the best days for bad news), the PHP team is all but begging admins to get their systems patched as soon as the updates drop. They even hinted at the possibility of dropping the fix earlier if they see these vulnerabilities being exploited. So, you know, no pressure.
Now, let’s get into the juicy bits: the vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619, and they’re both special little remote code execution (RCE) flaws. In simpler terms, hackers might get the chance to take over your server and start doing whatever they want. Fortunately, researchers say these flaws affect PHP versions 5 through 8 — so, if you're still clinging to the dinosaur that is PHP 4, congratulations! You won’t have to worry about this one.
WatchTowr, the security gurus, have confirmed that these vulnerabilities are the real deal. They were even supposed to release details on a Thursday (because nothing screams "trust me" like a secret schedule), but that plan went up in smoke with the leaks. So you can imagine how pleased everyone is about that.
Here's where it gets interesting: Cloudflare is already stepping in with an emergency update for their managed Web Application Firewall (WAF). They've confirmed that, yes, they are seeing early attacks — because what’s a good vulnerability without a few eager hackers chomping at the bit, right? They recommend that you actually install the official PHP patches when they become available, instead of relying solely on these temporary fixes.
If you’re in the mood for some DIY security, the cybersecurity experts suggest disabling PHP's session upload progress feature and blocking HTTP requests using 'multipart/form-data' content types. But you know, go ahead and disrupt your entire website while you're at it.
PHP developer Gina Peter Banyard has made it clear: there’s no substitute for the official patches. So treat any workaround as just that — a temporary band-aid on a gaping wound.
In summary, it’s panic time, folks. Make sure your updates are scheduled, because if you’re running PHP, you’ve got two critical flaws sitting right on your doorstep, and they’re not the kind that bring cookies.
