PHP emergency patches incoming for pair of critical flaws affecting millions of sites
The PHP maintainers have announced imminent releases to address two severe vulnerabilities rated 9.2 out of 10, with security researchers warning of mass exploitation within minutes of the patches becoming available.
System administrators managing web infrastructure should prepare for rapid deployment of security updates. The PHP development team disclosed Monday that two critical vulnerabilities would receive patches within approximately 12 hours, with both flaws carrying a severity score of 9.2 on a 10-point scale.
Waiting for PHP2Shell
The advisory from PHP maintainers stated: "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."
Following the circulation of unverified technical details, the PHP team moved to formalize its response. A video circulating online purportedly demonstrated an exploitation tool named PHP2Shell executing unauthorized code on servers hosting WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9—all applications built on PHP.
Security researchers at watchTowr confirmed that the vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, are genuine, though the original leaked report could not be independently verified. According to watchTowr's analysis, the flaws potentially impact every PHP version dating back to PHP 5 from 2004.
Analysts from Sansec predicted that "mass attacks to start within 15 minutes of the release." Webfence and Huntress have also issued their own advisories urging administrators to take immediate preparatory action.
Recommended preparation measures include:
- Identifying personnel responsible for PHP management within your organization
- Cataloging all applications and systems dependent on PHP
- Scheduling a maintenance window beginning at 14:00 UTC with provisions for an earlier deployment window
- Creating full backups of website files and associated databases
- Continuously monitoring PHP.net for announcements regarding accelerated release schedules
- Considering temporary disconnection of non-critical systems until patches are applied
As a foundational open-source language for web development, PHP underpins countless content management systems beyond WordPress, as well as numerous enterprise applications. An estimated 1.3 million internet-accessible hosts face potential exposure. Vulnerabilities of this severity rating carry substantial risk for widespread internet infrastructure damage. Administrators should remain alert for patch availability, which could occur ahead of the initially announced timeline.