PHP Issues Emergency Patch for Two Critical Remote‑Code Execution Flaws

PHP developers announced an out‑of‑cycle security update scheduled for 14:00 UTC on 21 October, addressing two newly disclosed remote‑code execution vulnerabilities that have been assigned a CVSS v4.0 score of 9.2, the highest severity rating in the framework's vulnerability taxonomy.

The flaws, identified by the independent research team watchTowr, are described only in broad terms by the PHP security team. Both weaknesses reside in core PHP components and can be exploited by unauthenticated attackers to execute arbitrary commands on vulnerable servers, a scenario that could compromise web applications, data stores, and underlying operating systems.

PHP powers an estimated 78 percent of the web’s server‑side code, making any critical flaw a matter of widespread concern. Historically, the language follows a regular release cadence, but the urgency of these bugs prompted an emergency patch outside the normal schedule. The decision underscores the potential impact of the vulnerabilities, which could be leveraged in mass‑scale attacks against poorly protected sites.

System administrators are urged to apply the patch as soon as it becomes available, ideally before the scheduled release time. The update is expected to be delivered through the standard distribution channels—PECL, package managers such as apt and yum, and the official PHP website. Administrators should also verify that their environments are not running outdated PHP versions that lack the new fix.

In the meantime, security best practices recommend limiting exposure of PHP services to trusted networks, employing web‑application firewalls, and disabling unnecessary functions that could aid exploitation. Organizations that cannot update immediately should consider temporary mitigations, such as disabling the vulnerable modules or restricting script execution permissions.

WatchTowr’s disclosure highlights the ongoing arms race between security researchers and software maintainers. While the exact technical details of the vulnerabilities remain undisclosed pending the patch, the high severity rating signals that attackers could achieve full system compromise without user interaction. The upcoming emergency release serves as a reminder that even mature platforms like PHP must remain vigilant against emerging threats.