flash on Nostr: ⚡️🚨 ALERT - Two leaked remote code execution flaws in PHP are real, watchTowr ...
⚡️🚨 ALERT - Two leaked remote code execution flaws in PHP are real, watchTowr confirms.
PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.
CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond "source: trust me, bro".
Kevin Beaumont flagged the leak, and watchTowr confirmed it two hours later.
PHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions.
Published at
2026-10-21 07:18:51 UTCEvent JSON
{
"id": "b567c052468c1179cc1378390f1838ef993520d37b4566dd78956f8642b33078",
"pubkey": "4d7842051782e0d3feb034d150adc2b6bae4ee3b49786793bffa468b6f5b96b3",
"created_at": 1792567131,
"kind": 1,
"tags": [
[
"client",
"Primal iOS"
]
],
"content": "⚡️🚨 ALERT - Two leaked remote code execution flaws in PHP are real, watchTowr confirms.\n\nPHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.\n\nCVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond \"source: trust me, bro\".\n\nKevin Beaumont flagged the leak, and watchTowr confirmed it two hours later.\n\nPHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions. \nhttps://blossom.primal.net/b75a63514bfd3a8055495a9d81d228a82a3a4aca8fcd02835b93d7b57904c50a.png\nhttps://blossom.primal.net/b70bd9d16e25a0846fa4dc2753ae6711a771f254865519dc9866bb0a1ba61d8d.jpg",
"sig": "841caccca458b70190bcd740a244a2e35de682eafac3842f5cb778ea7422a27dc936431e1af34ee7eacdf5e5a0b0eadb167b019534603a1a7a2a4c34615b0789"
}
