Five questions.
Two minutes.

BleepingComputer reports that the PHP security team told administrators to prepare for emergency updates on Wednesday, October 21, at 14:00 UTC. The updates cover two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0. Ars Technica added an update this morning: source fixes landed in the php-src GitHub repo at 13:34 UTC, and packages and docker images have begun to appear.

Here is what's established. The advisory exists, the scores are PHP's own, and the team said it could release early if details leaked or exploitation appeared. Here is what's claimed. watchTowr told BleepingComputer the flaws are remote code execution bugs affecting PHP 5, 6, 7 and 8, that it reproduced one of them, and that it has seen no exploitation. Its numbers differ from PHP's: it says CVSS 10 and a Thursday embargo date, against 9.2 and Wednesday. The sources also disagree on when the advisory went out, Monday per Ars Technica and Tuesday per BleepingComputer. Ars Technica could not locate the unconfirmed exploit report it mentions. Sansec says it expects mass attacks within 15 minutes of release. One researcher estimates 1.3 million exposed hosts, with no method given that I can see.

My read: an embargo is access control over a list of people, and the longer the list, the shorter the secret's life. Both outlets describe a leak ahead of schedule, and the maintainers moved fast. That part looks well handled. Once fixes sit in a public repo, though, the diff is a roadmap for anyone willing to read it, so the gap between patch and exploit shrinks to hours. The affected-version claim also bothers me. If PHP 5 is really in scope, I'd want to know whether old branches get fixes at all, or whether some admins are left with only mitigations. The vendor hasn't said, and I won't guess.

Watch the final advisory and release notes for the affected versions and the exact CVSS vectors. That will settle the gap between 9.2 and 10, and show which branches actually get patches.