The short version
- PHP maintainers announced plans to release patches for two vulnerabilities rated 9.2 out of 10 in severity within approximately twelve hours.
- Unconfirmed reports suggest the flaws affect all PHP versions released since 2004 and have been demonstrated in exploit tools targeting major content management systems.
- Security firms advise administrators to inventory assets, create backups, and prepare maintenance windows immediately due to the high likelihood of rapid exploitation.
Administrators managing web infrastructure are being urged to prepare for immediate action as maintainers of the PHP programming language announced plans to release emergency patches for two critical security vulnerabilities. The advisory, issued on Monday, indicates that fixes are scheduled to drop in slightly more than twelve hours. Both flaws have been assigned a severity rating of 9.2 out of a maximum possible score of 10, signaling a high potential for damage if left unaddressed.
The urgency stems from unconfirmed reports circulating within the security community regarding an exploit tool known as PHP2Shell. This tool is alleged to enable remote code execution on servers running various popular web applications built on PHP. While the original report has proven difficult to locate independently, a video demonstration has been shared online showing the tool successfully executing code on systems running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS.
Security firm watchTowr stated that it has confirmed the reality of the vulnerabilities, which are tracked under identifiers CVE-2026-109618 and CVE-2026-109619. According to the firm, these flaws affect every version of PHP released from 2004 onward. This broad scope is significant because PHP remains a foundational technology for much of the internet, powering not only major content management systems but also countless internal tools and dynamic web applications.
The maintainers emphasized that they reserve the right to release the patches earlier than scheduled if details of either vulnerability become public or if evidence of active exploitation appears in the wild. This contingency plan reflects the volatile nature of the situation, where the window between patch availability and widespread malicious use can be extremely narrow. The advisory explicitly encourages all users to prepare now so they can upgrade as soon as the release is available.
Industry experts are bracing for a rapid surge in attacks following the official release. Researchers from Sansec indicated that they expect mass attacks to begin within fifteen minutes of the patches becoming public. This prediction underscores the need for immediate preparation rather than waiting for the update to drop. Webfence and Huntress have also issued advisories urging administrators to take proactive steps to secure their environments.
Preparation involves several concrete steps for organizations relying on PHP-based systems. Administrators are advised to identify who is responsible for managing PHP within their organization and to take a comprehensive inventory of every application built on the language. Planning a maintenance window starting at 14:00 UTC is recommended, with contingency plans in place for an earlier release time. Additionally, creating backups of site and database files is considered essential before applying any updates.
Some security professionals suggest more drastic measures for non-essential systems, recommending that they be unplugged or isolated until they can be patched. This approach minimizes the attack surface during the period of heightened risk. Monitoring the official PHP.net homepage for late-breaking announcements is also critical, as the release timeline could shift based on emerging intelligence about exploitation efforts.
The potential impact of these vulnerabilities is substantial given the ubiquity of PHP in web development. One security researcher estimated that approximately 1.3 million internet-connected hosts are likely affected by these flaws. With severity ratings this high, the vulnerabilities have the potential to inflict major damage across the internet if exploited at scale. The situation highlights the ongoing challenges of maintaining security in widely adopted open-source technologies.
As the deadline approaches, the focus remains on vigilance and readiness. The patches can be released at any moment, leaving little room for delay once they are available. Organizations must balance the need for stability with the imperative to address these severe risks promptly. The coming hours will test the preparedness of web administrators worldwide as they navigate this significant security event.
The incident serves as a reminder of the interconnected nature of modern web infrastructure and the cascading effects of vulnerabilities in core technologies. While the exact details of the exploits remain partially unconfirmed by independent verification beyond watchTowr's assessment, the consensus among security firms is clear: immediate action is required. The next phase will involve the actual deployment of patches and the subsequent monitoring for any signs of exploitation in the wild.
Sources behind this briefing
Go to the original reporting
- Ars Technica↗PHP warns it plans to release 2 emergency patches imminently
