Since last night it’s clear that anyone running PHP is in for an unusual day. The PHP security team has announced an out-of-band security release on php.net for today, Wednesday 21 October 2026, at 14:00 UTC (16:00 CEST). It fixes two critical vulnerabilities, both rated CVSS v4.0 9.2.

What makes this unusual: according to security firm watchTowr, information about the flaws leaked before the release. watchTowr confirms the vulnerabilities are real, describes them as remote code execution, and says it has reproduced one of them. The identifiers in circulation are CVE-2026-109618 and CVE-2026-109619. PHP explicitly reserved the right to release early if details became public, and that has now happened.

What we don’t know yet

There’s a lot of speculation going around. Here are the facts, separated from rumour:

• Affected versions: PHP will only publish the exact list with the release. The claim that “every version since PHP 5” is affected is not officially confirmed.
• Attack vector: No public technical details exist, so there’s no reliable workaround either.
• Exploitation: No exploitation in the wild has been reported so far. That can change quickly once patches ship and attackers start diffing them.

Why this matters for Magento

Magento 2 and Adobe Commerce run entirely on PHP. A store is public-facing and handles customer and payment data, which is exactly what attackers go after after disclosures like this. With CosmicSting and PolyShell, mass scanning started within hours of the patches.

Checklist: do this now, not at 14:00 UTC

1. Inventory: Find every server, container and pipeline that runs PHP, and note the version. CLI (php -v) and PHP-FPM may run different versions. Include cron jobs, queue consumers and build servers.
2. Know your update path: Find out where your PHP comes from (distro packages, ondřej PPA, Remi, official Docker images or managed hosting) and how fast each source ships fixes. Distro packages often lag.
3. Book a maintenance window: It starts at 14:00 UTC or whenever the patch lands. Have staging ready and smoke tests prepared: checkout, admin login, cron, indexers.
4. After updating: Restart PHP-FPM, flush OPcache, and verify the version in the web context, not just on the CLI.
5. Legacy PHP: If you’re still on unsupported versions (e.g. 7.4, 8.0, 8.1), expect no official patch. You need an emergency plan now.
6. Raise monitoring: Watch logs, WAF alerts and file integrity closely over the coming days, especially new PHP files in pub/, pub/media/ and var/.

Our advice

Don’t panic, but don’t wait either. Get everything ready today so you can patch as soon as the release lands. We’ll update this post when PHP publishes the affected and fixed versions.

Running a Magento store and not sure whether your servers are affected, or who will apply the update? Get in touch. We can help check and patch at short notice.

Sources: php.net – Upcoming Critical PHP Security Release · watchTowr – CVE-2026-109618 FAQ · Cyber Daily. As of 21 Oct 2026.