Key points
- Two vulnerabilities with 9.2 severity ratings are scheduled for patching.
- An exploit tool named PHP2Shell reportedly targets multiple PHP applications.
- No confirmed fix exists yet, but maintainers may release updates early.
PHP maintainers announced Monday that patches for two severe vulnerabilities are planned for release soon. Both flaws carry a severity rating of 9.2 out of 10. The advisory urges all users to prepare their systems for the upgrade immediately. The team reserves the right to publish the fixes earlier if active exploitation evidence emerges. This warning follows the leak of unconfirmed details regarding the vulnerabilities.
In plain English
The issues track as CVE-2026-109618 and CVE-2026-109619. Security firm watchTowr confirmed these vulnerabilities are real. The flaws reportedly affect every PHP version released since 2004. An exploit tool called PHP2Shell was shown executing code on various web servers. This tool targeted applications built on the PHP language, demonstrating the potential impact of these unpatched systems.
The background
A leaked report included a video showing the PHP2Shell tool in action. The demonstration targeted several specific software versions, including WordPress 7.1.3, MediaWiki 1.46.2, and phpBB 3.3.17. Other affected applications in the video included Magento 2.4.9, Joomla 6.2.0, and Drupal 11.4.10. The footage also showed exploitation of Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, and WHMCS 9.0.9.
What changes now
Researchers from Sansec anticipate mass attacks could begin shortly after the patch release. Webfence and Huntress have also issued advisories urging immediate preparation. One researcher estimated 1.3 million internet-connected hosts might be affected. Admins are advised to plan maintenance windows starting at 14:00 UTC. They should also monitor the PHP.net homepage for any sudden changes to the release schedule.
Who needs to act first
Teams should prioritize systems exposed directly to the internet. Identify which applications rely on PHP and verify their current versions. Create complete backups of site files and databases before making changes. Plan to apply updates during a scheduled maintenance window. If possible, isolate non-essential systems until patches are available. Monitor vendor channels closely for early release announcements that might require immediate action.
What to do and how to stay safe: PHP
- Inventory all applications running PHP to determine exposure levels.
- Prepare maintenance windows and backup strategies before the release.
- Monitor official channels for early patch availability or exploitation news.
- Isolate non-critical systems to reduce potential attack surface temporarily.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which CVEs are involved in this PHP advisory?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
Is there a patch available now?
No, patches are scheduled for release soon but have not been confirmed as available yet.
Which PHP versions are affected by these flaws?
Reports indicate the vulnerabilities affect every PHP version from PHP 5 onward.
