2026年10月20日周二，PHP开发团队建议管理员为周三（10月21日）14:00 UTC计划发布的紧急安全更新做好准备。补丁针对两个严重漏洞，CVSS v4.0评分均为9.2。
PHP Security Team Prepares Emergency Patches for Two Critical RCE Flaws Following Leak On Tuesday, October 20, 2026, the PHP development team advised administrators to prepare for emergency security updates scheduled for Wednesday, October 21, at 14:00 UTC. The patches address two critical vulnerabilities rated 9.2 under CVSS v4.0.
此次公告是在漏洞信息泄露后发布的，网络安全公司watchTowr将这些缺陷认定为远程代码执行漏洞，编号为CVE-2026-109618和CVE-2026-109619。安全研究人员认为，这些漏洞影响PHP 5、6、7和8版本。
The announcement followed leaks concerning the flaws, which cybersecurity firm watchTowr identified as remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Security researchers believe the flaws affect PHP versions 5, 6, 7, and 8.
虽然研究人员已验证漏洞存在，但确认目前尚未观察到实际在野利用。
While researchers verified the vulnerabilities, they confirmed no active in-the-wild exploitation has been observed yet.