PHP to ship emergency patches for two critical flaws

PHP's security team is set to publish an out-of-cycle security release today, Wednesday, October 21, at 14:00 UTC (10:00 a.m. Eastern), fixing two vulnerabilities that each carry a 9.2 rating under CVSS v4.0, according to an advance notice on php.net. The notice asked all PHP users to "prepare now so they can upgrade as soon as the release is available." The team said it may release earlier if details become public or if attacks appear in the wild. The warning arrived after information about the embargoed bugs leaked. PHP runs a large share of the web, so administrators are now preparing for a patch whose technical details are still unknown.bleepingcomputer.com

Leak and confirmation

On October 20, a Hacker News post that has since been deleted claimed that two critical PHP remote code execution flaws would be disclosed on October 22. It listed them as CVE-2026-109618 and CVE-2026-109619 and gave both a CVSS score of 10.0, BleepingComputer reported. Security firm watchTowr then confirmed the flaws exist. "We can confirm that these vulnerabilities are indeed real," CEO Benjamin Harris told the outlet. He said the bugs are understood to affect PHP 5, 6, 7 and 8. watchTowr said it believes it has reproduced CVE-2026-109618 and has seen no exploitation in the wild.bleepingcomputer.com

PHP posted its notice at 19:33 UTC on October 20, setting the release one day before the embargo date watchTowr had cited. The notice does not name either CVE, and the claim that all versions back to PHP 5 are affected has not been confirmed. Researchers have nicknamed the pair "php2shell." Ars Technica noted an unconfirmed report that a PHP2Shell exploit can run code remotely. Huntress said a short video of the exploit was briefly posted online and then taken down, and that it knows of no public exploit code.huntress.com+2

Older versions may get no fix

Fixes can only reach PHP's four supported branches, 8.2 through 8.5 (The Hacker News; PHP). Versions 8.1, 8.0, 7.x and 5.x are end of life. If the flaws affect them, those installations will get no official patch. Security company Mallory counted about 884,000 internet-facing hosts whose banners report PHP 8.1 or older, according to The Hacker News.thehackernews.com+1

Preparing to patch

CERT-EU advised organizations to prepare to patch immediately. Where that is not possible, it suggested isolating internet-facing applications from public networks. Huntress urged administrators to inventory every PHP install, including copies bundled in appliances and control panels such as cPanel and Plesk, and to patch internet-facing systems first. It also recommended watching for PHP worker processes that launch shells or download tools.cert.europa.eu+1

PHP has said that "full details, affected versions, and the fixed versions will be published with the release". Until then, it is unclear which part of PHP is affected and whether attacks require a particular configuration.php.net