Details of two critical PHP flaws leak ahead of planned patches
PHP says fixes for the two critical-severity bugs, publicly dubbed PHP2Shell, are planned for Wednesday, 21 October 2026 at 14:00 UTC, and urges users to prepare to upgrade immediately.
Details of two critical-severity PHP vulnerabilities, publicly nicknamed PHP2Shell, leaked online before a scheduled coordinated disclosure and official patches, SecurityWeek reported.
PHP said patches for both issues, each carrying a CVSS score of 9.2, are planned for Wednesday, 21 October 2026 at 14:00 UTC. The project told all PHP users to prepare now so they can upgrade as soon as the release lands, and said fixes could ship earlier if technical details are published or evidence of exploitation appears.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and could lead to remote code execution. CERT-EU says the CVSS score suggests both could be exploited without authentication. The public details so far don't include a root cause, affected component or attack path, though one report describes the first as a use-after-free bug. Public reporting suggests all PHP versions from PHP 5 onward are affected.
WatchTowr said it reproduced CVE-2026-109618 but withheld technical detail until patches ship. Its CEO, Benjamin Harris, said the vulnerabilities "are indeed real." WatchTowr and Huntress said they had not seen exploitation in the wild. Sansec expects mass exploitation to likely begin within 15 minutes of the patch release.
For defenders, the practical step is inventory: find where PHP runs, including embedded and containerized deployments, and be ready to move quickly once fixed versions are published.
CVE references
Sources
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning