Update Oct 21, 2026, 1:00 p.m. UTC: Ahead of the official patch release scheduled for 2:00 p.m. UTC, system administrators worldwide are taking preventative measures. With technical details regarding the alleged PHP2Shell exploit already circulating publicly, numerous organizations have proactively taken portals offline. In the Netherlands, this led to temporary outages for major government platforms, including MijnOverheid, DigiD, and the House of Representatives. Internationally, cybersecurity authorities such as the UK NCSC and the US CISA have sounded the alarm.
Foreign universities, Magento-based e-commerce platforms, and public forums running on phpBB or vBulletin are disabling public-facing web interfaces to prevent remote code execution. Meanwhile, security vendors such as Cloudflare and Akamai report that automated scans and probes hunting for vulnerable endpoints have already begun worldwide.
In practice, these proactive shutdowns mean downtime will almost certainly extend beyond 2:00 p.m. UTC. Until the PHP maintainers release the official security updates for CVE-2026-109618 and CVE-2026-109619, severing public internet exposure remains the only guaranteed defense against potential server takeovers.
For hosting providers and DevOps teams, the remediation workload only begins once the patches are published. This includes downloading the fixes, validating them across staging environments to avoid compatibility issues with existing web applications, and deploying them to production servers. For complex architectures running highly customized code, this process could easily stretch well into the evening.
Not every organization has pulled the emergency brake. Major platforms like Wikipedia (predominantly powered by MediaWiki) and Meta rely on their own, heavily modified PHP runtimes (such as HHVM), Web Application Firewalls (WAFs), and microservice architectures, making them less vulnerable to standard upstream PHP library flaws.
Companies utilizing PHP purely as a static presentation layer without direct ties to sensitive backend databases or authentication services are also largely keeping their sites online under heightened monitoring. For organizations running public form inputs, shopping carts, or authenticated customer portals, however, preventative downtime remains the safest path until the updates are deployed.
Original article Oct 21, 2026, 7:40 a.m. UTC: The PHP maintainers are releasing two emergency updates to address serious security vulnerabilities. The vulnerabilities have a CVSS score of 9.2.
The security updates are expected to be released on October 21 at 2:00 p.m. UTC. According to Ars Technica, there is a good chance the patches will be made public earlier if technical details are leaked. This also applies if there are indications of active exploitation.
Security firm watchTowr reports that the vulnerabilities have been registered as CVE-2026-109618 and CVE-2026-109619. According to the company, all PHP versions starting with PHP 5 may be vulnerable. This means that older websites and applications may also be at risk. Security specialists at Sansec expect massive attacks to begin within 15 minutes of the announcement.
Potential for remote code execution
The various warnings follow reports of an exploit called PHP2Shell. The PHP maintainers published the advisory in response to the leak of alleged details, which have yet to be confirmed. The leaked information included a video showing an exploit tool named PHP2Shell executing code on web servers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symfony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9. All of these applications use PHP.
The authenticity of the demonstration and the exploit’s exact behavior have not yet been independently confirmed. Nor is it certain whether the mentioned applications are vulnerable under all circumstances. The potential security issue lies within PHP itself, meaning the consequences are not limited to a single specific content management system. In early 2026, a vulnerability in Cloudflare was also found to enable the exploitation of security flaws in PHP applications.
As an open-source scripting language for building dynamic websites and web apps, PHP has become a de facto building block for the web. In addition to WordPress, other CMS applications also use PHP. PHP also forms the basis for many internal tools. A security researcher reported that an estimated 1.3 million internet-connected hosts are likely vulnerable. Vulnerabilities in these hosts could cause significant damage on the internet.
Organizations are advised to take inventory of their PHP installations and the applications that depend on them. They should also create backups and prepare maintenance windows. Administrators may want to consider temporarily disabling non-essential services until the updates are installed.
The PHP developers advise administrators to follow the announcements on PHP.net. As soon as the security updates are available, prompt installation is necessary to minimize the risk of exploitation.