The PHP maintainers are releasing two emergency updates to address serious security vulnerabilities. The vulnerabilities have a CVSS score of 9.2.
The security updates are expected to be released on October 21 at 2:00 p.m. UTC (4:00 p.m. Dutch time). According to Ars Technica, there is a good chance the patches will be made public earlier if technical details are leaked. This also applies if there are indications of active exploitation.
Security firm watchTowr reports that the vulnerabilities have been registered as CVE-2026-109618 and CVE-2026-109619. According to the company, all PHP versions starting with PHP 5 may be vulnerable. This means that older websites and applications may also be at risk. Security specialists at Sansec expect massive attacks to begin within 15 minutes of the announcement.
Potential for remote code execution
The various warnings follow reports of an exploit called PHP2Shell. The PHP maintainers published the advisory in response to the leak of alleged details, which have yet to be confirmed. The leaked information included a video showing an exploit tool named PHP2Shell executing code on web servers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. All of these applications use PHP.
The authenticity of the demonstration and the exploit’s exact behavior have not yet been independently confirmed. Nor is it certain whether the mentioned applications are vulnerable under all circumstances. The potential security issue lies within PHP itself, meaning the consequences are not limited to a single specific content management system. In early 2026, a vulnerability in Cloudflare was also found to enable the exploitation of security flaws in PHP applications.
As an open-source scripting language for building dynamic websites and web apps, PHP has become a de facto building block for the web. In addition to WordPress, other CMS applications also use PHP. PHP also forms the basis for many internal tools. A security researcher reported that an estimated 1.3 million internet-connected hosts are likely vulnerable. Vulnerabilities in these hosts could cause significant damage on the internet.
Organizations are advised to take inventory of their PHP installations and the applications that depend on them. They should also create backups and prepare maintenance windows. Administrators may want to consider temporarily disabling non-essential services until the updates are installed.
The PHP developers advise administrators to follow the announcements on PHP.net. As soon as the security updates are available, prompt installation is necessary to minimize the risk of exploitation.