PHP developers plan to urgently release two patches — Ars Technica

PHP developers have warned of plans to release two urgent security updates for vulnerabilities in the near future, each of which has a severity rating of 9.2 out of 10. All PHP users were advised to prepare for the update in advance, Ars Technica reports.

Two critical vulnerabilities

The developers' notice states that the release of the fixes may occur earlier than scheduled if details of the issues become public or evidence of their active exploitation emerges. The vulnerabilities are tracked under the identifiers CVE-2026-109618 and CVE-2026-109619.

More current news is available on the UA.News Telegram channel Telegram.

The warning appeared after unconfirmed details leaked about an exploitation tool allegedly called PHP2Shell. According to the publication, a video from the leak showed remote code execution on web servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Drupal, and other applications using PHP. The company watchTowr said it had confirmed the existence of both vulnerabilities.

Administrators' preparation

Security specialists advise administrators to identify those responsible for PHP in their organizations, compile a list of applications in this language, prepare backups of websites and databases, and schedule a maintenance window for the update. Sansec researchers expect that mass attacks may begin within 15 minutes after the fixes are released. One researcher estimated the number of potentially vulnerable internet-connected hosts at 1.3 million.